Differences

This shows you the differences between two versions of the page.

--- public:99_annexes:annex-b-terms-and-definitions:c:compliance [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1
+++ public:99_annexes:annex-b-terms-and-definitions:c:compliance [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
@@ Line 1: / Line 1: @@
+====== Compliance ======
+[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
+===== Discussion =====
+Compliance is the condition of satisfying specified legal, regulatory, contractual, policy, standard, control, benchmark, or other applicable criteria.
+A Compliance determination depends on the defined:
+  * Subject
+  * Applicable criteria
+  * Controlling sources
+  * Controlling source [[public:99_annexes:annex-b-terms-and-definitions:v:version|Versions]]
+  * Scope
+  * Operating context
+  * Assessment method
+  * [[public:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]
+  * Time of evaluation
+  * Applicable [[public:99_annexes:annex-b-terms-and-definitions:a:authority|Authority]]
+Compliance can apply to:
+  * A [[public:99_annexes:annex-b-terms-and-definitions:c:candidate_solution|Candidate Solution]]
+  * A [[public:99_annexes:annex-b-terms-and-definitions:d:distributed_system|Distributed System]]
+  * A system
+  * A service
+  * A process
+  * An [[public:99_annexes:annex-b-terms-and-definitions:o:organization|Organization]]
+  * An [[public:99_annexes:annex-b-terms-and-definitions:a:actor|Actor]]
+  * A [[public:99_annexes:annex-b-terms-and-definitions:n:node|Node]]
+  * A [[public:99_annexes:annex-b-terms-and-definitions:q:qualified_node|Qualified Node]]
+  * A [[public:99_annexes:annex-b-terms-and-definitions:n:node_set|Node Set]]
+  * An artifact
+  * A [[public:99_annexes:annex-b-terms-and-definitions:c:configuration|Configuration]]
+  * A [[public:99_annexes:annex-b-terms-and-definitions:t:test_environment|Test Environment]]
+  * An individual control
+  * Another subject governed by applicable criteria
+A subject can comply with one set of criteria while failing to comply with another.
+Applicable criteria can originate from:
+  * [[public:99_annexes:annex-b-terms-and-definitions:r:requirement|Requirements]]
+  * Laws
+  * Regulations
+  * Contracts
+  * Agreements
+  * [[public:99_annexes:annex-b-terms-and-definitions:g:governance_policy|Governance Policies]]
+  * Standards
+  * Specifications
+  * Controls
+  * Benchmarks
+  * Decisions of an applicable Authority
+  * Other controlling sources
+A Compliance evaluation can result in a determination such as:
+  * Satisfied
+  * Not satisfied
+  * Partially satisfied
+  * Not applicable
+  * Not evaluated
+  * Inconclusive
+  * Another status established by the applicable criteria
+The controlling source, Governance Policy, [[public:99_annexes:annex-b-terms-and-definitions:v:validation_criteria|Validation Criteria]], or [[public:99_annexes:annex-b-terms-and-definitions:a:acceptance_criteria|Acceptance Criteria]] establishes the permitted Compliance determinations.
+Compliance differs from [[public:99_annexes:annex-b-terms-and-definitions:a:accreditation|Accreditation]]. Compliance establishes satisfaction of specified criteria, while Accreditation provides formal recognition within a defined scope and operating context.
+===== Definition =====
+//condition of satisfying specified legal, regulatory, contractual, policy, standard, control, benchmark, or other applicable criteria//
+===== Source =====
+Generalized from:
+  * Conformity assessment
+  * Governance
+  * Risk management
+  * Regulatory practice
+  * Security engineering
+  * Quality management
+Specialized for:
+  * Crucible architecture and operations
+  * DIDO Reference Architecture
+  * DIDO Reference Implementation Conceptual Model
+  * DIDO-TE comparative evaluation and Validation
+The original definition and its approved intent are preserved.
+===== Note =====
+Compliance is not an absolute property without a stated reference.
+A Compliance claim should identify:
+  * The subject
+  * The applicable criteria
+  * The controlling source
+  * The controlling source Version
+  * The evaluation scope
+  * The operating context
+  * The assessment method
+  * The evaluation time
+  * The applicable Authority
+  * The supporting Evidence
+Evidence supports a Compliance determination but does not by itself establish that the subject satisfies the applicable criteria.
+Compliance differs from [[public:99_annexes:annex-b-terms-and-definitions:e:evaluation_characteristic|Evaluation Characteristic]]:
+  * An Evaluation Characteristic identifies a characteristic selected for measurement, observation, comparison, or evaluation
+  * Compliance identifies the condition of satisfying applicable criteria
+A comparative evaluation can evaluate the Compliance of multiple Candidate Solutions, but Compliance does not become a Quality Characteristic solely because it participates in the evaluation.
+Compliance differs from [[public:99_annexes:annex-b-terms-and-definitions:s:security|Security]]:
+  * Compliance concerns satisfaction of applicable criteria
+  * Security concerns protection of information, operations, and Resources according to applicable authorization and security constraints
+A subject can satisfy specified security criteria while retaining security risks not addressed by those criteria.
+A subject can implement effective security controls but fail Compliance because it does not satisfy an applicable documentation, authorization, reporting, retention, or Evidence obligation.
+Compliance differs from a [[public:99_annexes:annex-b-terms-and-definitions:v:verdict|Verdict]]:
+  * Compliance identifies a condition relative to applicable criteria
+  * A Verdict records an evaluation assigned to a [[public:99_annexes:annex-b-terms-and-definitions:t:test_result|Test Result]]
+Multiple Test Results and Verdicts can support one Compliance determination.
+Compliance differs from a [[public:99_annexes:annex-b-terms-and-definitions:v:validation_decision|Validation Decision]]:
+  * Compliance identifies the condition of satisfying applicable criteria
+  * A Validation Decision records a determination produced by evaluating information against Validation Criteria
+A Validation Decision can establish or support the Compliance status of a subject.
+An approved exception, waiver, or deviation does not erase the underlying criterion. The Compliance record should preserve:
+  * The underlying criterion
+  * The approved exception, waiver, or deviation
+  * The approving Authority
+  * The approval period
+  * The approval conditions
+  * The supporting Evidence
+  * The applicable [[public:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]]
+  * The applicable [[public:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]]
+===== Example =====
+A Hardened Image satisfies the applicable requirements of a selected [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] profile at the time of assessment.
+The Compliance claim applies to:
+  * The identified Hardened Image
+  * The selected STIG profile
+  * The STIG profile Version
+  * The recorded Configuration
+  * The assessment scope
+  * The assessment method
+  * The evaluation time
+  * The supporting Evidence
+In a DIDO-TE comparative evaluation, three Candidate Solutions are evaluated against the same regulatory, security, retention, audit, interoperability, and Evidence-preservation criteria.
+[[public:99_annexes:annex-b-terms-and-definitions:d:dido-te|DIDO-TE]] preserves Traceability among each Candidate Solution, applicable criterion, controlling source, Test Definition, Test Result, Verdict, Compliance determination, and supporting Evidence.
+----
+<WRAP centeralign>
+© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
+</WRAP>