1.3 Intended Audience

Go to 1. Introduction

Crucible addresses the needs of organizations and stakeholders responsible for designing, funding, governing, building, assessing, authorizing, deploying, operating, maintaining, or auditing controlled software and Infrastructure Environments.

The intended audience includes:

• Executives and Organizational Leaders who allocate resources, establish shared capabilities, evaluate organizational risk, and seek to reduce duplicated engineering and lifecycle costs across multiple products
• Program Managers and Product Managers who evaluate business value, implementation status, delivery risk, provider support, resource needs, and roadmap priorities
• System Owners who define the mission, operational, security, compliance, and lifecycle expectations for deployed systems and environments
• Governance Bodies that establish policies, controls, approval criteria, technical direction, and organizational responsibilities
• Authorizing Authorities that evaluate risk, assessment results, and supporting Evidence when making authorization or Operational Approval decisions
• Enterprise Architects, System Architects, and Solution Architects who define architectural boundaries, shared responsibilities, provider contracts, interfaces, and lifecycle controls
• Platform Engineers who construct and maintain reusable Platforms, deployment environments, provider integrations, and automation services
• DevSecOps Engineers who integrate image construction, infrastructure deployment, Compliance Assessment, Dependency Capture, and Evidence generation into automated workflows and pipelines
• Software Factory Engineers who establish and operate Software Factories
• Infrastructure Engineers who define and deploy resources through Infrastructure as Code (IaC)
• Image Engineers who construct, harden, sign, verify, promote, and maintain Machine Images
• Cybersecurity Engineers who select security and compliance criteria, apply hardening, assess configurations, review Compliance Findings, and evaluate security controls
• Compliance Officers who evaluate compliance criteria, assessment results, findings, exceptions, claims, and supporting Evidence
• Auditors who examine Traceability, Provenance, assessment results, lifecycle records, and Auditability
• Enclave Operators who import, deploy, operate, and maintain approved content within Disconnected Environments and Air-Gapped Environments
• Infrastructure Providers, Cloud Providers, Platform Providers, Image Providers, and Compliance Providers that implement provider-specific behavior through controlled extension points
• Application Teams and Product Teams that consume approved images, infrastructure resources, platform services, Baselines, and deployment environments
• Developers and Maintainers who extend Crucible subsystems, providers, plugins, compliance integrations, or tooling interfaces

Different audiences require different levels of detail.

Executives, Organizational Leaders, Program Managers, Product Managers, System Owners, and Governance Bodies can focus on the purpose, scope, operational mission, organizational value, actors, responsibilities, operational outcomes, and authorization boundaries.

Architects and Engineers can focus on the operational context, Baseline Composition, image construction, infrastructure deployment, provider abstraction, dependency capture, compliance operations, connected and disconnected workflows, and interface behavior.

Cybersecurity Engineers, Compliance Officers, Auditors, and Authorizing Authorities can focus on Compliance Assessments, Compliance Findings, Evidence, Provenance, Traceability, transfer controls, and support for authorization activities.

Operators, Application Teams, Product Teams, and Automated Systems can focus on the operational sequences, required inputs, produced outputs, deployment activities, disconnected operations, and the Command-Line Interface (CLI) or Web-Based User Interface (Web UI) through which they interact with Crucible.

The Crucible documentation distinguishes operational concepts, normative requirements, controlled terminology, and implementation guidance so each audience can identify the information relevant to its responsibilities.