| Both sides previous revision Previous revision | |
| dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010b [2026/07/30 13:27] – nick_dido | dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:fr-comp-010b [2026/07/30 13:28] (current) – nick_dido |
|---|
| ===== Statement ===== | ===== Statement ===== |
| |
| [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL preserve the association between each Compliance Finding and the [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] to which the Compliance Finding applies when transferring them in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]]. | [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL preserve the association between each [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] and the [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] to which the Compliance Finding applies when transferring them in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]]. |
| |
| ===== Derived From ===== | ===== Derived From ===== |
| The Original Requirement states: | The Original Requirement states: |
| |
| > //The system shall capture compliance findings into the transferable dependency/evidence bundle (see §4.10) so findings from connected build accompany artifacts into disconnected enclave.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] | > //The system shall capture [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|compliance findings]] into the transferable dependency/evidence bundle (see §4.10) so findings from connected build accompany artifacts into disconnected enclave.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] |
| |
| FR-COMP-010b: | FR-COMP-010b: |
| * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] | * Replaces **The system** with the defined system name [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] |
| * Changes **shall** to the established uppercase normative form **SHALL** | * Changes **shall** to the established uppercase normative form **SHALL** |
| * Extracts preservation of the association between Compliance Findings and affected Artifacts as an independently verifiable requirement | * Extracts preservation of the association between [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] and affected Artifacts as an independently verifiable requirement |
| * Replaces **transferable dependency/evidence bundle** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] | * Replaces **transferable dependency/evidence bundle** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] |
| * Replaces **connected build** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] | * Replaces **connected build** with the controlled term [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] |
| ===== Rationale ===== | ===== Rationale ===== |
| |
| A Compliance Finding remains useful after transfer only when its association with the evaluated [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] remains identifiable. | A [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] remains useful after transfer only when its association with the evaluated [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] remains identifiable. |
| |
| Preserving this association enables actors and processes in a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] to determine which Compliance Findings apply to each transferred Artifact. | Preserving this association enables actors and processes in a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] to determine which [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] apply to each transferred Artifact. |
| |
| FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. This requirement governs preservation of the association between them. | FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. This requirement governs preservation of the association between them. |
| This requirement does not require Crucible to: | This requirement does not require Crucible to: |
| |
| * Generate Compliance Findings | * Generate [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] |
| * Validate Compliance Findings | * Validate Compliance Findings |
| * Resolve Compliance Findings | * Resolve Compliance Findings |
| |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] |
| * Compliance Findings | * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifacts]] | * [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifacts]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundles]] | * [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundles]] |
| Verification confirms that: | Verification confirms that: |
| |
| - An [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] with one or more associated Compliance Findings is selected for testing | - An [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] with one or more associated [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Findings]] is selected for testing |
| - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] includes the selected Artifact and its associated Compliance Findings in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] | - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] includes the selected Artifact and its associated Compliance Findings in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] |
| - Crucible transfers the Transfer Bundle from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] | - Crucible transfers the Transfer Bundle from a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]] to a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] |
| ===== Issues ===== | ===== Issues ===== |
| |
| <todo>Determine whether Compliance Finding requires a controlled definition in the shared Terms and Definitions corpus.</todo> | <todo>Confirm the controlled definition of Compliance Finding in the shared Terms and Definitions corpus.</todo> |
| |
| <todo>Determine whether separate requirements define the identifier or reference mechanism used to preserve the association between a Compliance Finding and an Artifact.</todo> | <todo>Determine whether separate requirements define the identifier or reference mechanism used to preserve the association between a Compliance Finding and an Artifact.</todo> |
| This page is a leaf requirement page and omits a trailing '':start'' from its namespace. | This page is a leaf requirement page and omits a trailing '':start'' from its namespace. |
| |
| The Statement addresses only preservation of the association between each Compliance Finding and the Artifact to which the Compliance Finding applies during transfer between Connected and Disconnected Environments. | The Statement addresses only preservation of the association between each [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] and the [[dido:99_annexes:annex-b-terms-and-definitions:a:artifact|Artifact]] to which the Compliance Finding applies during transfer between Connected and Disconnected Environments. |
| |
| FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. | FR-COMP-010a governs inclusion of Compliance Findings and affected Artifacts in the same [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]. |
| | |
| | Use the following controlling Terms and Definitions entry for Compliance Finding: |
| | |
| | * [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_finding|Compliance Finding]] |
| |
| Do not add finding generation, validation, resolution, remediation, reassessment, identifier-format, or compliance-decision obligations unless the controlling requirement changes through an approved requirements process. | Do not add finding generation, validation, resolution, remediation, reassessment, identifier-format, or compliance-decision obligations unless the controlling requirement changes through an approved requirements process. |