Compliance Finding [Dido Solutions, Inc Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Compliance Finding ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

A Compliance Finding is a recorded result produced by evaluating a specified subject against an applicable compliance criterion.

The finding may record satisfaction, non-satisfaction, non-applicability, inability to determine, execution error, or another result permitted by the applicable assessment method.

A Compliance Finding may identify the evaluated criterion, subject, benchmark and profile versions, assessment time, method, observed value, expected value, severity, rationale, remediation information, and supporting [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]].

Within Crucible, a Compliance Provider may produce scanner-specific findings that the compliance engine transforms into a common or normalized findings representation.

===== Definition =====

//recorded result produced by evaluating a specified subject against an applicable compliance criterion//

===== Source =====

Generalized from conformity assessment, security assessment, audit, control evaluation, and compliance-scanning usage and specialized for the Crucible architecture and operational model.

===== Note =====

A Compliance Finding records the result for a single criterion or a bounded evaluation. A collection of Compliance Findings supports a broader determination of compliance.

A finding of non-satisfaction does not by itself determine the acceptability of the associated risk. The applicable governance and authorization process evaluates the finding, context, remediation, exceptions, and residual risk.

===== Example =====

An assessment evaluates a [[dido:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 Machine Image against a [[dido:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] rule requiring a specified audit configuration. The resulting Compliance Finding records whether the image satisfies the rule and preserves the observed configuration and supporting evidence.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>