FR-COMP-009 — Security-Control Implementation Evidence

Go to Crucible Compliance Management Requirements

Original Requirement

The system shall generate security-control implementation evidence suitable for supporting SCTM, RMF, and ATO processes.[C1]

Assessment of Original Requirement

The Original Requirement identifies three distinct uses for Security-Control Implementation Evidence:

Inclusion in a Security Control Traceability Matrix (SCTM)Use in Risk Management Framework (RMF) activitiesUse in Authorization to Operate (ATO) activitiesEach use has a distinct purpose and requires separate verification. The Original Requirement should therefore be decomposed into three leaf requirements.

Generation of Security-Control Implementation Evidence is the common behavior across the three leaf requirements. It does not require a separate leaf because the Original Requirement does not establish an independent Evidence-generation obligation outside the SCTM, RMF, and ATO contexts.

The phrase suitable for supporting does not identify an observable behavior or the characteristics that make the Evidence suitable. Each child Statement therefore identifies the intended use directly.

The decomposition does not assign security-control approval, risk-management, risk-acceptance, authorization, or operational approval responsibilities to Crucible.

Proposed Statements

The Original Requirement is decomposed into:

FR-COMP-009a — Security Control Traceability Matrix Evidence

Crucible SHALL generate Security-Control Implementation Evidence for inclusion in a Security Control Traceability Matrix (SCTM).

FR-COMP-009b — Risk Management Framework Evidence

Crucible SHALL generate Security-Control Implementation Evidence for use in Risk Management Framework (RMF) activities.

FR-COMP-009c — Authorization to Operate Evidence

Crucible SHALL generate Security-Control Implementation Evidence for use in Authorization to Operate (ATO) activities.

Contents

Requirement Status

Issues

Notes for Editors

This page is a non-leaf requirement page and therefore retains a trailing :start in its namespace.

The namespace for this requirement is:

dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-009:start

The child requirements are leaf pages nested beneath the FR-COMP-009 namespace and omit a trailing :start.

Use the following controlling Terms and Definitions entries:

The decomposition contains three leaf requirements because the Original Requirement identifies three uses of Security-Control Implementation Evidence.

Do not create a separate generic Evidence-generation leaf unless the controlling source adds an independent requirement to generate Security-Control Implementation Evidence outside the SCTM, RMF, and ATO contexts.

FR-COMP-009 does not require Crucible to:

Approve a Security Control implementationPerform the responsibilities of a control assessorMake a risk-management decisionAccept residual riskIssue an Authorization to OperateAct as an Authorizing AuthorityDo not add Security Control approval, assessment authority, risk acceptance, authorization, or operational approval responsibilities unless the controlling requirement changes through an approved requirements process.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.