Compliance Profile

Go up to Terms and Definitions

A Compliance Profile is a defined selection, specialization, or tailoring of compliance criteria from one or more Compliance Benchmarks for a specified subject, purpose, or operating context.

The profile identifies which criteria apply and may also identify parameter values, implementation expectations, assessment procedures, exceptions, severity assignments, or remediation guidance.

A Compliance Profile allows a broad benchmark to support different technologies, missions, environments, assurance levels, or organizational requirements without treating every criterion as universally applicable.

Within Crucible, the Compliance Profile helps determine which checks and remediation content apply to a particular operating system, image role, or deployment context.

defined selection, specialization, or tailoring of compliance criteria from one or more compliance benchmarks for a specified subject, purpose, or operating context

Generalized from conformity assessment, security configuration, control tailoring, policy profiling, and machine-processable compliance content and specialized for the Crucible architecture and operational model.

A Compliance Profile should identify its source benchmark, version, applicability, selected criteria, parameters, and tailoring decisions.

Selecting a Compliance Profile does not establish that the evaluated subject satisfies the selected criteria.

A Security Technical Implementation Guide (STIG) data stream contains a Compliance Profile for Red Hat Enterprise Linux (RHEL) 9. Crucible selects that profile when assessing the corresponding Hardened Image.