Compliance

Go up to Terms and Definitions

Discussion

Compliance is the condition of satisfying specified legal, regulatory, contractual, policy, standard, control, benchmark, or other applicable criteria.

A Compliance determination depends on the defined:

SubjectApplicable criteriaControlling sourcesControlling source VersionsScopeOperating contextAssessment methodEvidenceTime of evaluationApplicable AuthorityCompliance can apply to:

A Candidate SolutionA Distributed SystemA systemA serviceA processAn OrganizationAn ActorA NodeA Qualified NodeA Node SetAn artifactA ConfigurationA Test EnvironmentAn individual controlAnother subject governed by applicable criteriaA subject can comply with one set of criteria while failing to comply with another.

Applicable criteria can originate from:

LawsRegulationsContractsAgreementsGovernance PoliciesStandardsSpecificationsControlsBenchmarksDecisions of an applicable AuthorityOther controlling sourcesA Compliance evaluation can result in a determination such as:

SatisfiedNot satisfiedPartially satisfiedNot applicableNot evaluatedInconclusiveAnother status established by the applicable criteriaThe controlling source, Governance Policy, Validation Criteria, or Acceptance Criteria establishes the permitted Compliance determinations.

Compliance differs from Accreditation. Compliance establishes satisfaction of specified criteria, while Accreditation provides formal recognition within a defined scope and operating context.

Definition

condition of satisfying specified legal, regulatory, contractual, policy, standard, control, benchmark, or other applicable criteria

Source

Generalized from:

Conformity assessmentGovernanceRisk managementRegulatory practiceSecurity engineeringQuality managementSpecialized for:

Crucible architecture and operationsDIDO Reference ArchitectureDIDO Reference Implementation Conceptual ModelDIDO-TE comparative evaluation and ValidationThe original definition and its approved intent are preserved.

Note

Compliance is not an absolute property without a stated reference.

A Compliance claim should identify:

The subjectThe applicable criteriaThe controlling sourceThe controlling source VersionThe evaluation scopeThe operating contextThe assessment methodThe evaluation timeThe applicable AuthorityThe supporting EvidenceEvidence supports a Compliance determination but does not by itself establish that the subject satisfies the applicable criteria.

Compliance differs from Evaluation Characteristic:

An Evaluation Characteristic identifies a characteristic selected for measurement, observation, comparison, or evaluationCompliance identifies the condition of satisfying applicable criteriaA comparative evaluation can evaluate the Compliance of multiple Candidate Solutions, but Compliance does not become a Quality Characteristic solely because it participates in the evaluation.

Compliance differs from Security:

Compliance concerns satisfaction of applicable criteriaSecurity concerns protection of information, operations, and Resources according to applicable authorization and security constraintsA subject can satisfy specified security criteria while retaining security risks not addressed by those criteria.

A subject can implement effective security controls but fail Compliance because it does not satisfy an applicable documentation, authorization, reporting, retention, or Evidence obligation.

Compliance differs from a Verdict:

Compliance identifies a condition relative to applicable criteriaA Verdict records an evaluation assigned to a Test ResultMultiple Test Results and Verdicts can support one Compliance determination.

Compliance differs from a Validation Decision:

Compliance identifies the condition of satisfying applicable criteriaA Validation Decision records a determination produced by evaluating information against Validation CriteriaA Validation Decision can establish or support the Compliance status of a subject.

An approved exception, waiver, or deviation does not erase the underlying criterion. The Compliance record should preserve:

The underlying criterionThe approved exception, waiver, or deviationThe approving AuthorityThe approval periodThe approval conditionsThe supporting EvidenceThe applicable ProvenanceThe applicable Traceability

Example

A Hardened Image satisfies the applicable requirements of a selected Security Technical Implementation Guide (STIG) profile at the time of assessment.

The Compliance claim applies to:

The identified Hardened ImageThe selected STIG profileThe STIG profile VersionThe recorded ConfigurationThe assessment scopeThe assessment methodThe evaluation timeThe supporting EvidenceIn a DIDO-TE comparative evaluation, three Candidate Solutions are evaluated against the same regulatory, security, retention, audit, interoperability, and Evidence-preservation criteria.

DIDO-TE preserves Traceability among each Candidate Solution, applicable criterion, controlling source, Test Definition, Test Result, Verdict, Compliance determination, and supporting Evidence.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.