FR-COMP-008 — Operating-System-Independent Compliance Scanning

Go to Crucible Compliance Management Requirements

Original Requirement

The system shall provide an operating-system-agnostic compliance scanning abstraction. Compliance scanning shall not be limited to a single operating system (the current OpenSCAP/RHEL-9 integration is one concrete provider behind this abstraction).[C1]

Assessment of Original Requirement

The Original Requirement contains two distinct normative obligations:

Provision of a compliance scanning abstractionCompliance scanning across more than one operating systemThese obligations require separate verification and therefore should be represented by separate leaf requirements.

The parenthetical reference to the current OpenSCAP and RHEL 9 integration identifies an implementation example. It does not establish an additional normative obligation and should not appear in a child requirement Statement.

The phrase operating-system-agnostic is replaced with operating-system-independent to align the requirement title and avoid implying complete absence of operating-system-specific implementation components.

Contents

Requirement Status

Issues

Notes for Editors

This page is a non-leaf requirement page and therefore retains a trailing :start in its namespace.

The child requirements are leaf pages and omit a trailing :start from their namespaces.

The OpenSCAP and RHEL 9 reference describes one implementation of the abstraction and does not create a requirement to use either technology.

Do not add requirements for dynamic provider loading, plugin discovery, provider registration, common result formats, or automatic operating-system detection unless the controlling source adds those obligations.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.