FR-COMP-010 — Transferable Compliance Findings

Go to Crucible Compliance Management Requirements

The system shall capture compliance findings into the transferable dependency/evidence bundle (see §4.10) so findings from connected build accompany artifacts into disconnected enclave.[C1]

The Original Requirement contains two distinct obligations:

1. Inclusion of Compliance Findings in the transferable dependency/evidence bundle
2. Preservation of the relationship between the Compliance Findings and the Artifacts they describe when transferred from a Connected Environment to a Disconnected Environment

These obligations require separate verification and therefore should be represented by separate leaf requirements.

The phrase transferable dependency/evidence bundle is normalized to the controlled term Transfer Bundle.

The phrase connected build does not identify a defined architectural object. The decomposition instead identifies the Connected Environment as the source environment.

The phrase disconnected enclave is normalized to the controlled term Disconnected Environment unless the architecture establishes Enclave as a distinct controlled concept.

The decomposition does not require Crucible to generate Compliance Findings, resolve Compliance Findings, or determine whether a transferred Artifact complies with a Compliance Baseline.

The Original Requirement is decomposed into:

1. FR-COMP-010a — Compliance Finding Transfer Bundle Inclusion
2. FR-COMP-010b — Compliance Finding Association Preservation

Crucible SHALL include Compliance Findings in the Transfer Bundle containing the Artifacts to which the Compliance Findings apply.

Crucible SHALL preserve the association between each Compliance Finding and the Artifact to which the Compliance Finding applies when transferring the Artifact from a Connected Environment to a Disconnected Environment.

Review and approve the decomposition of FR-COMP-010.

Create and approve FR-COMP-010a.

Create and approve FR-COMP-010b.

Determine whether Compliance Finding requires a controlled definition in the shared Terms and Definitions corpus.

Confirm that Transfer Bundle is the controlling term for the source phrase transferable dependency/evidence bundle.

Determine whether the source term disconnected enclave means Disconnected Environment or requires a distinct Enclave definition.

Determine whether separate requirements govern verification of Compliance Findings and their Artifact associations after Transfer Bundle import.

This page is a non-leaf requirement page and therefore retains a trailing :start in its namespace.

The namespace for this requirement is:

dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-06-compliance-management:fr-comp-010:start

The child requirements are leaf pages nested beneath the FR-COMP-010 namespace and omit a trailing :start.

Use the following controlling Terms and Definitions entries:

• Transfer Bundle
• Artifact
• Connected Environment
• Disconnected Environment

The decomposition separates inclusion of Compliance Findings in a Transfer Bundle from preservation of the relationship between each Compliance Finding and the Artifact it describes.

FR-COMP-010 does not require Crucible to:

• Generate the Compliance Findings
• Determine the validity of the Compliance Findings
• Resolve the Compliance Findings
• Remediate the affected Artifacts
• Reassess the affected Artifacts
• Determine whether the affected Artifacts comply with a Compliance Baseline

Do not add finding generation, validation, resolution, remediation, reassessment, or compliance-decision responsibilities unless the controlling requirement changes through an approved requirements process.