| Next revision | Previous revision |
| dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010b [2026/07/30 13:25] – created nick_dido | dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010b [2026/07/30 13:28] (current) – nick_dido |
|---|
| ===== Statement ===== | ===== Statement ===== |
| |
| [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL preserve the association between each Compliance Finding and the [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] to which the Compliance Finding applies when transferring the Artifact from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]]. | [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL preserve the association between each [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] and the [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] to which the Compliance Finding applies when transferring them in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]]. |
| |
| ===== Derived From ===== | ===== Derived From ===== |
| The Original Requirement states: | The Original Requirement states: |
| |
| > //The system shall capture compliance findings into the transferable dependency/evidence bundle (see §4.10) so findings from connected build accompany artifacts into disconnected enclave.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] | > //The system shall capture [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|compliance findings]] into the transferable dependency/evidence bundle (see §4.10) so findings from connected build accompany artifacts into disconnected enclave.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] |
| |
| FR-COMP-010b: | FR-COMP-010b: |
| * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] | * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] |
| * Changes **shall** to the established uppercase normative form **SHALL** | * Changes **shall** to the established uppercase normative form **SHALL** |
| * Extracts preservation of the relationship between Compliance Findings and affected Artifacts as an independently verifiable requirement | * Extracts preservation of the association between [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] and affected Artifacts as an independently verifiable requirement |
| | * Replaces **transferable dependency/evidence bundle** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] |
| * Replaces **connected build** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] | * Replaces **connected build** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] |
| * Replaces **disconnected enclave** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] | * Replaces **disconnected enclave** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] |
| * Assigns inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] to FR-COMP-010a | * Assigns inclusion of Compliance Findings and affected Artifacts in the same Transfer Bundle to FR-COMP-010a |
| |
| ===== Rationale ===== | ===== Rationale ===== |
| |
| A Compliance Finding has meaning only when its relationship to the evaluated [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] remains identifiable. | A [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] remains useful after transfer only when its association with the evaluated [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] remains identifiable. |
| |
| Preserving this association during transfer enables actors and processes in a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] to determine which Compliance Findings apply to each transferred Artifact. | Preserving this association enables actors and processes in a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] to determine which [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] apply to each transferred Artifact. |
| |
| This requirement establishes association preservation without requiring Crucible to: | FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. This requirement governs preservation of the association between them. |
| |
| * Generate the Compliance Findings | This requirement does not require Crucible to: |
| * Validate the Compliance Findings | |
| * Resolve the Compliance Findings | |
| * Remediate the affected Artifacts | |
| * Reassess the affected Artifacts | |
| * Determine whether the affected Artifacts comply with a Compliance Baseline | |
| * Preserve an association between a Compliance Finding and an Artifact to which the finding does not apply | |
| |
| FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. | * Generate [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] |
| | * Validate Compliance Findings |
| | * Resolve Compliance Findings |
| | * Remediate affected Artifacts |
| | * Reassess affected Artifacts |
| | * Determine whether affected Artifacts comply with a Compliance Baseline |
| |
| ===== Applies To ===== | ===== Applies To ===== |
| |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] |
| * Compliance Findings | * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifacts]] | * [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifacts]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundles]] | * [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundles]] |
| Verification confirms that: | Verification confirms that: |
| |
| - An [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] with one or more associated Compliance Findings is selected for testing | - An [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] with one or more associated [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] is selected for testing |
| - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] transfers the selected Artifact and its associated Compliance Findings from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] | - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] includes the selected Artifact and its associated Compliance Findings in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] |
| | - Crucible transfers the Transfer Bundle from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] |
| - The transferred Artifact can be identified in the Disconnected Environment | - The transferred Artifact can be identified in the Disconnected Environment |
| - Each transferred Compliance Finding can be identified in the Disconnected Environment | - Each transferred Compliance Finding can be identified in the Disconnected Environment |
| - The association between each transferred Compliance Finding and the Artifact to which the Compliance Finding applies can be determined in the Disconnected Environment | - The association between each transferred Compliance Finding and the Artifact to which it applies can be determined in the Disconnected Environment |
| |
| ===== Referenced By ===== | ===== Referenced By ===== |
| ===== Issues ===== | ===== Issues ===== |
| |
| <todo>Determine whether Compliance Finding requires a controlled definition in the shared Terms and Definitions corpus.</todo> | <todo>Confirm the controlled definition of Compliance Finding in the shared Terms and Definitions corpus.</todo> |
| |
| <todo>Determine whether separate requirements define the identifier or reference mechanism used to preserve the association between a Compliance Finding and an Artifact.</todo> | <todo>Determine whether separate requirements define the identifier or reference mechanism used to preserve the association between a Compliance Finding and an Artifact.</todo> |
| This page is a leaf requirement page and omits a trailing '':start'' from its namespace. | This page is a leaf requirement page and omits a trailing '':start'' from its namespace. |
| |
| The namespace for this requirement is: | The Statement addresses only preservation of the association between each [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] and the [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] to which the Compliance Finding applies during transfer between Connected and Disconnected Environments. |
| | |
| ''dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010b'' | |
| | |
| The Statement addresses only preservation of the association between each Compliance Finding and the Artifact to which the Compliance Finding applies. | |
| |
| FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. | FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. |
| |
| The Statement uses the controlling environment terms: | Use the following controlling Terms and Definitions entry for Compliance Finding: |
| |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] | |
| |
| Do not add finding generation, validation, resolution, remediation, reassessment, identifier-format, or compliance-decision obligations unless the controlling requirement changes through an approved requirements process. | Do not add finding generation, validation, resolution, remediation, reassessment, identifier-format, or compliance-decision obligations unless the controlling requirement changes through an approved requirements process. |