FR-COMP-009b — Risk Management Framework Evidence

Go to FR-COMP-009 — Security-Control Implementation Evidence

Crucible SHALL generate Security-Control Implementation Evidence for use in Risk Management Framework (RMF) activities.

This requirement derives from:

• FR-COMP-009 — Security-Control Implementation Evidence
• Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-COMP-009

The Original Requirement states:

The system shall generate security-control implementation evidence suitable for supporting SCTM, RMF, and ATO processes.[C1]

FR-COMP-009b:

• Replaces The system with the defined system name Crucible
• Changes shall to the established uppercase normative form SHALL
• Extracts generation of Security-Control Implementation Evidence for the RMF context as an independently verifiable requirement
• Replaces the weak phrase suitable for supporting RMF processes with the direct purpose for use in Risk Management Framework activities
• Assigns SCTM Evidence to FR-COMP-009a
• Assigns ATO Evidence to FR-COMP-009c

The Risk Management Framework (RMF) provides a structured process for managing security, privacy, and related risks throughout a system lifecycle.

Security-Control Implementation Evidence provides information that RMF participants can use when reviewing the implementation and assessment of Security Controls.

Such Evidence can support RMF activities involving:

• Control implementation
• Control assessment
• Authorization preparation
• Continuous monitoring
• Risk review
• Corrective-action planning

This requirement establishes generation of Security-Control Implementation Evidence for use in RMF activities without requiring Crucible to:

• Select Security Controls
• Approve Security Control implementations
• Perform the responsibilities of a control assessor
• Determine whether a Security Control operates effectively
• Categorize a system
• Make a risk-management decision
• Accept residual risk
• Perform the responsibilities of an Authorizing Authority
• Issue an Authorization to Operate (ATO)

Separate requirements, architecture specifications, evidence profiles, and RMF procedures govern those subjects and responsibilities.

This requirement applies to:

• Crucible
• Security-Control implementations
• Security-Control Implementation Evidence
• Risk Management Framework (RMF) activities

Verification confirms that:

1. A Security Control implementation is selected for testing
2. An RMF activity requiring Security-Control Implementation Evidence is identified
3. Crucible generates Security-Control Implementation Evidence for the selected implementation
4. The generated Evidence identifies or references the Security Control implementation that the Evidence describes
5. The generated Evidence can be used as input to the identified RMF activity
6. The relationship between the generated Evidence and the identified RMF activity can be determined

The following pages reference this requirement:

Implemented and Verified

Review and approve FR-COMP-009b as a leaf requirement.

Determine whether Security Control requires a controlled definition in the shared Terms and Definitions corpus.

Determine whether Security-Control Implementation Evidence requires a controlled definition in the shared Terms and Definitions corpus.

Determine whether separate requirements define the minimum identifiers, provenance, and references required for Evidence used in RMF activities.

Determine whether separate requirements identify the RMF activities for which Crucible must generate Evidence.

This requirement page retains the derived requirement identifier FR-COMP-009b.

This page is a leaf requirement page and omits a trailing :start from its namespace.

The namespace for this requirement is:

dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009b

The Statement addresses only generation of Security-Control Implementation Evidence for use in Risk Management Framework activities.

FR-COMP-009a governs Evidence generated for inclusion in a Security Control Traceability Matrix.

FR-COMP-009c governs Evidence generated for use in Authorization to Operate activities.

This requirement does not assign RMF responsibilities to Crucible. RMF participants remain responsible for control selection, implementation decisions, assessment, risk management, authorization, and monitoring decisions.

Do not add Security Control selection, control approval, assessment authority, risk acceptance, authorization, or operational approval responsibilities unless the controlling requirement changes through an approved requirements process.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:fr-comp-009b#Statement&noheader&nofooter&noeditbtn}}