Accredited Software Factory [Dido Solutions, Inc Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Accredited Software Factory ======

[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

An Accredited Software Factory is a [[public:99_annexes:annex-b-terms-and-definitions:s:software_factory|Software Factory]] that operates within an approved [[public:99_annexes:annex-b-terms-and-definitions:a:accreditation_boundary|Accreditation Boundary]] under an [[public:99_annexes:annex-b-terms-and-definitions:o:operational_approval|Operational Approval]] issued by an [[public:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|Authorizing Authority]].

The accreditation applies to the factory configuration, implemented controls, operating processes, supporting [[public:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]], and operational context included within the approved boundary.

[[public:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] supports the construction and reproduction of a Software Factory through controlled baselines, hardened machine images, traceable dependencies, reproducible deployments, and compliance evidence. Crucible does not grant accreditation or operational approval.

===== Definition =====

//[[public:99_annexes:annex-b-terms-and-definitions:s:software_factory|software factory]] that operates within an approved [[public:99_annexes:annex-b-terms-and-definitions:a:accreditation_boundary|accreditation boundary]] under an [[public:99_annexes:annex-b-terms-and-definitions:o:operational_approval|operational approval]] issued by an [[public:99_annexes:annex-b-terms-and-definitions:a:authorizing_authority|authorizing authority]]//

===== Source =====

Generalised from software-factory, security-accreditation, and risk-management usage and specialized for the Crucible architecture and operational model.

===== Note =====

Accreditation applies to the approved boundary, configuration, controls, operating processes, and operational context. Accreditation of the Software Factory does not automatically establish accreditation of every product produced by the factory or every environment into which a product is deployed.

A Software Factory that implements security controls or produces compliance evidence does not become an Accredited Software Factory until an Authorizing Authority issues the applicable Operational Approval.

===== Example =====

An organization uses Crucible to reproduce a Software Factory from pinned source repositories, hardened machine images, controlled infrastructure baselines, captured dependencies, and traceable evidence of compliance. An Authorizing Authority evaluates the defined Accreditation Boundary and issues an Operational Approval for the factory.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>