Compliance Posture

Go up to Terms and Definitions

A Compliance Posture is the defined set of compliance conditions, expectations, criteria, assessment settings, remediation policy, and evidence obligations applicable to a system, artefact, environment, service, or process.

The posture identifies what compliance means for the applicable subject and operating context. It may identify a Compliance Benchmark, selected profile, tailoring decisions, remediation setting, assessment stage, accepted exceptions, and required evidence.

A Compliance Posture may be declared before an assessment and evaluated after implementation. The declared posture states the applicable expectations, while the assessed posture reflects the resulting findings and evidence.

Within Crucible, a Crucible Description, image definition, or Baseline Composition may identify the Compliance Posture applied during an Image Build.

defined compliance condition, expectations, criteria, assessment settings, remediation policy, and evidence obligations applicable to a specified subject and operating context

Generalized from compliance management, security posture, conformity assessment, policy management, and risk-management usage and specialized for the Crucible architecture and operational model.

A Compliance Posture differs from a Compliance Baseline. The Compliance Posture describes the applicable compliance expectations and conditions. The Compliance Baseline identifies the approved configuration of criteria, profiles, controls, settings, and evidence requirements used as the controlled reference.

A declared Compliance Posture does not establish that the subject satisfies the declared criteria.

A Crucible Description declares a Compliance Posture that selects a Security Technical Implementation Guide (STIG) for Red Hat Enterprise Linux (RHEL) 9, enables remediation, requires pre-remediation and post-remediation scans, and requires preservation of the resulting evidence.