Differences

This shows you the differences between two versions of the page.

--- public:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1
+++ public:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
@@ Line 1: / Line 1: @@
+====== Compliance Benchmark ======
+[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
+===== Discussion =====
+A Compliance Benchmark is a defined collection of criteria, checks, configuration expectations, assessment procedures, or evaluation rules used to determine [[public:99_annexes:annex-b-terms-and-definitions:c:compliance|Compliance]] for a specified subject and operating context.
+The benchmark may apply to an operating system, application, service, [[public:99_annexes:annex-b-terms-and-definitions:p:platform|Platform]], [[public:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Image]], infrastructure environment, or organizational process.
+A Compliance Benchmark may identify individual rules, severity levels, control references, applicability conditions, assessment methods, remediation guidance, and expected evidence.
+A [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] can serve as a Compliance Benchmark for a defined product or technology. Within Crucible, the selected benchmark forms part of the applicable [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] and [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_posture|Compliance Posture]].
+===== Definition =====
+//defined collection of criteria, checks, configuration expectations, assessment procedures, or evaluation rules used to determine compliance for a specified subject and operating context//
+===== Source =====
+Generalized from conformity assessment, cybersecurity, configuration assessment, quality management, and regulatory-compliance usage and specialized for the Crucible architecture and operational model.
+===== Note =====
+A Compliance Benchmark should identify its issuing authority, version, applicable subject, scope, and assessment context.
+Applying a Compliance Benchmark does not establish compliance unless the assessment evaluates the applicable criteria and records the resulting findings and evidence.
+===== Example =====
+A Crucible Image Baseline selects a [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] for [[public:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 as the Compliance Benchmark for a Hardened Image.
+----
+<WRAP centeralign>
+© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
+</WRAP>