Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | |||
| public:99_annexes:annex-b-terms-and-definitions:c:compliance [2026/09/12 17:42] – ↷ Page moved from private:99_annexes:annex-b-terms-and-definitions:c:compliance to public:99_annexes:annex-b-terms-and-definitions:c:compliance nick_dido | public:99_annexes:annex-b-terms-and-definitions:c:compliance [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Compliance ====== | ====== Compliance ====== | ||
| - | [[private: | + | [[public: |
| ===== Discussion ===== | ===== Discussion ===== | ||
| Line 12: | Line 12: | ||
| * Applicable criteria | * Applicable criteria | ||
| * Controlling sources | * Controlling sources | ||
| - | * Controlling source [[private: | + | * Controlling source [[public: |
| * Scope | * Scope | ||
| * Operating context | * Operating context | ||
| * Assessment method | * Assessment method | ||
| - | * [[private: | + | * [[public: |
| * Time of evaluation | * Time of evaluation | ||
| - | * Applicable [[private: | + | * Applicable [[public: |
| Compliance can apply to: | Compliance can apply to: | ||
| - | * A [[private: | + | * A [[public: |
| - | * A [[private: | + | * A [[public: |
| * A system | * A system | ||
| * A service | * A service | ||
| * A process | * A process | ||
| - | * An [[private: | + | * An [[public: |
| - | * An [[private: | + | * An [[public: |
| - | * A [[private: | + | * A [[public: |
| - | * A [[private: | + | * A [[public: |
| - | * A [[private: | + | * A [[public: |
| * An artifact | * An artifact | ||
| - | * A [[private: | + | * A [[public: |
| - | * A [[private: | + | * A [[public: |
| * An individual control | * An individual control | ||
| * Another subject governed by applicable criteria | * Another subject governed by applicable criteria | ||
| Line 42: | Line 42: | ||
| Applicable criteria can originate from: | Applicable criteria can originate from: | ||
| - | * [[private: | + | * [[public: |
| * Laws | * Laws | ||
| * Regulations | * Regulations | ||
| * Contracts | * Contracts | ||
| * Agreements | * Agreements | ||
| - | * [[private: | + | * [[public: |
| * Standards | * Standards | ||
| * Specifications | * Specifications | ||
| Line 65: | Line 65: | ||
| * Another status established by the applicable criteria | * Another status established by the applicable criteria | ||
| - | The controlling source, Governance Policy, [[private: | + | The controlling source, Governance Policy, [[public: |
| - | Compliance differs from [[private: | + | Compliance differs from [[public: |
| ===== Definition ===== | ===== Definition ===== | ||
| Line 112: | Line 112: | ||
| Evidence supports a Compliance determination but does not by itself establish that the subject satisfies the applicable criteria. | Evidence supports a Compliance determination but does not by itself establish that the subject satisfies the applicable criteria. | ||
| - | Compliance differs from [[private: | + | Compliance differs from [[public: |
| * An Evaluation Characteristic identifies a characteristic selected for measurement, | * An Evaluation Characteristic identifies a characteristic selected for measurement, | ||
| Line 119: | Line 119: | ||
| A comparative evaluation can evaluate the Compliance of multiple Candidate Solutions, but Compliance does not become a Quality Characteristic solely because it participates in the evaluation. | A comparative evaluation can evaluate the Compliance of multiple Candidate Solutions, but Compliance does not become a Quality Characteristic solely because it participates in the evaluation. | ||
| - | Compliance differs from [[private: | + | Compliance differs from [[public: |
| * Compliance concerns satisfaction of applicable criteria | * Compliance concerns satisfaction of applicable criteria | ||
| Line 128: | Line 128: | ||
| A subject can implement effective security controls but fail Compliance because it does not satisfy an applicable documentation, | A subject can implement effective security controls but fail Compliance because it does not satisfy an applicable documentation, | ||
| - | Compliance differs from a [[private: | + | Compliance differs from a [[public: |
| * Compliance identifies a condition relative to applicable criteria | * Compliance identifies a condition relative to applicable criteria | ||
| - | * A Verdict records an evaluation assigned to a [[private: | + | * A Verdict records an evaluation assigned to a [[public: |
| Multiple Test Results and Verdicts can support one Compliance determination. | Multiple Test Results and Verdicts can support one Compliance determination. | ||
| - | Compliance differs from a [[private: | + | Compliance differs from a [[public: |
| * Compliance identifies the condition of satisfying applicable criteria | * Compliance identifies the condition of satisfying applicable criteria | ||
| Line 150: | Line 150: | ||
| * The approval conditions | * The approval conditions | ||
| * The supporting Evidence | * The supporting Evidence | ||
| - | * The applicable [[private: | + | * The applicable [[public: |
| - | * The applicable [[private: | + | * The applicable [[public: |
| ===== Example ===== | ===== Example ===== | ||
| - | A Hardened Image satisfies the applicable requirements of a selected [[private: | + | A Hardened Image satisfies the applicable requirements of a selected [[public: |
| The Compliance claim applies to: | The Compliance claim applies to: | ||
| Line 170: | Line 170: | ||
| In a DIDO-TE comparative evaluation, three Candidate Solutions are evaluated against the same regulatory, security, retention, audit, interoperability, | In a DIDO-TE comparative evaluation, three Candidate Solutions are evaluated against the same regulatory, security, retention, audit, interoperability, | ||
| - | [[private: | + | [[public: |
| ---- | ---- | ||