Compliance Finding

Go up to Terms and Definitions

A Compliance Finding is a recorded result produced by evaluating a specified subject against an applicable compliance criterion.

The finding may record satisfaction, non-satisfaction, non-applicability, inability to determine, execution error, or another result permitted by the applicable assessment method.

A Compliance Finding may identify the evaluated criterion, subject, benchmark and profile versions, assessment time, method, observed value, expected value, severity, rationale, remediation information, and supporting Evidence.

Within Crucible, a Compliance Provider may produce scanner-specific findings that the compliance engine transforms into a common or normalized findings representation.

recorded result produced by evaluating a specified subject against an applicable compliance criterion

Generalized from conformity assessment, security assessment, audit, control evaluation, and compliance-scanning usage and specialized for the Crucible architecture and operational model.

A Compliance Finding records the result for a single criterion or a bounded evaluation. A collection of Compliance Findings supports a broader determination of compliance.

A finding of non-satisfaction does not by itself determine the acceptability of the associated risk. The applicable governance and authorization process evaluates the finding, context, remediation, exceptions, and residual risk.

An assessment evaluates a Red Hat Enterprise Linux (RHEL) 9 Machine Image against a Security Technical Implementation Guide (STIG) rule requiring a specified audit configuration. The resulting Compliance Finding records whether the image satisfies the rule and preserves the observed configuration and supporting evidence.