dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start [2026/07/30 13:12] – removed - external edit (Unknown date) 127.0.0.1dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start [2026/07/30 13:20] (current) – nick_dido
Line 1: Line 1:
 +====== FR-COMP-009 — Security-Control Implementation Evidence ======
  
 +[[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:start|Go to Crucible Compliance Management Requirements]]
 +
 +===== Original Requirement =====
 +
 +> //The system shall generate security-control implementation evidence suitable for supporting [[dido:99_annexes:annex-b-terms-and-definitions:s:sctm|SCTM]], [[dido:99_annexes:annex-b-terms-and-definitions:r:rmf|RMF]], and [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|ATO]] processes.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]
 +
 +===== Assessment of Original Requirement =====
 +
 +The Original Requirement identifies three distinct uses for Security-Control Implementation [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]:
 +
 +  - Inclusion in a [[dido:99_annexes:annex-b-terms-and-definitions:s:sctm|Security Control Traceability Matrix (SCTM)]]
 +  - Use in [[dido:99_annexes:annex-b-terms-and-definitions:r:rmf|Risk Management Framework (RMF)]] activities
 +  - Use in [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|Authorization to Operate (ATO)]] activities
 +
 +Each use has a distinct purpose and requires separate verification. The Original Requirement should therefore be decomposed into three leaf requirements.
 +
 +Generation of Security-Control Implementation Evidence is the common behavior across the three leaf requirements. It does not require a separate leaf because the Original Requirement does not establish an independent Evidence-generation obligation outside the SCTM, RMF, and ATO contexts.
 +
 +The phrase **suitable for supporting** does not identify an observable behavior or the characteristics that make the Evidence suitable. Each child Statement therefore identifies the intended use directly.
 +
 +The decomposition does not assign security-control approval, risk-management, risk-acceptance, authorization, or operational approval responsibilities to [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]].
 +
 +===== Contents =====
 +
 +{{indexmenu>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009#1|js navbar nocookie maxjs#1 id#fr_comp_009_nav}}
 +
 +===== Requirement Status =====
 +
 +<todo>Review and approve the decomposition of FR-COMP-009.</todo>
 +
 +<todo>Create and approve FR-COMP-009a.</todo>
 +
 +<todo>Create and approve FR-COMP-009b.</todo>
 +
 +<todo>Create and approve FR-COMP-009c.</todo>
 +
 +----
 +===== Issues =====
 +
 +<todo>Determine whether Security Control requires a controlled definition in the shared Terms and Definitions corpus.</todo>
 +
 +<todo>Determine whether Security-Control Implementation Evidence requires a controlled definition in the shared Terms and Definitions corpus.</todo>
 +
 +<todo>Determine whether separate requirements define the minimum content, identifiers, provenance, and references required for Security-Control Implementation Evidence.</todo>
 +
 +<todo>Determine which Evidence characteristics are required for inclusion in an SCTM.</todo>
 +
 +<todo>Determine which Evidence characteristics are required for use in RMF activities.</todo>
 +
 +<todo>Determine which Evidence characteristics are required for use in ATO activities.</todo>
 +
 +----
 +===== Notes for Editors =====
 +
 +This page is a non-leaf requirement page and therefore retains a trailing '':start'' in its namespace.
 +
 +The namespace for this requirement is:
 +
 +''dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start''
 +
 +The child requirements are leaf pages nested beneath the FR-COMP-009 namespace and omit a trailing '':start''.
 +
 +Use the following controlling Terms and Definitions entries:
 +
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:s:sctm|Security Control Traceability Matrix (SCTM)]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:r:rmf|Risk Management Framework (RMF)]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:a:ato|Authorization to Operate (ATO)]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]
 +
 +The decomposition contains three leaf requirements because the Original Requirement identifies three uses of Security-Control Implementation Evidence.
 +
 +Do not create a separate generic Evidence-generation leaf unless the controlling source adds an independent requirement to generate Security-Control Implementation Evidence outside the SCTM, RMF, and ATO contexts.
 +
 +FR-COMP-009 does not require Crucible to:
 +
 +  * Approve a Security Control implementation
 +  * Perform the responsibilities of a control assessor
 +  * Make a risk-management decision
 +  * Accept residual risk
 +  * Issue an Authorization to Operate
 +  * Act as an [[dido:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|Authorizing Authority]]
 +
 +Do not add Security Control approval, assessment authority, risk acceptance, authorization, or operational approval responsibilities unless the controlling requirement changes through an approved requirements process.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>