| Both sides previous revision Previous revision | |
| public:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark [2026/09/12 17:42] – ↷ Page moved from private:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark to public:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark nick_dido | public:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido |
|---|
| ====== Compliance Benchmark ====== | ====== Compliance Benchmark ====== |
| |
| [[private:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] | [[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] |
| |
| ===== Discussion ===== | ===== Discussion ===== |
| |
| A Compliance Benchmark is a defined collection of criteria, checks, configuration expectations, assessment procedures, or evaluation rules used to determine [[private:99_annexes:annex-b-terms-and-definitions:c:compliance|Compliance]] for a specified subject and operating context. | A Compliance Benchmark is a defined collection of criteria, checks, configuration expectations, assessment procedures, or evaluation rules used to determine [[public:99_annexes:annex-b-terms-and-definitions:c:compliance|Compliance]] for a specified subject and operating context. |
| |
| The benchmark may apply to an operating system, application, service, [[private:99_annexes:annex-b-terms-and-definitions:p:platform|Platform]], [[private:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Image]], infrastructure environment, or organizational process. | The benchmark may apply to an operating system, application, service, [[public:99_annexes:annex-b-terms-and-definitions:p:platform|Platform]], [[public:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Image]], infrastructure environment, or organizational process. |
| |
| A Compliance Benchmark may identify individual rules, severity levels, control references, applicability conditions, assessment methods, remediation guidance, and expected evidence. | A Compliance Benchmark may identify individual rules, severity levels, control references, applicability conditions, assessment methods, remediation guidance, and expected evidence. |
| |
| A [[private:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] can serve as a Compliance Benchmark for a defined product or technology. Within Crucible, the selected benchmark forms part of the applicable [[private:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] and [[private:99_annexes:annex-b-terms-and-definitions:c:compliance_posture|Compliance Posture]]. | A [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] can serve as a Compliance Benchmark for a defined product or technology. Within Crucible, the selected benchmark forms part of the applicable [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]] and [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_posture|Compliance Posture]]. |
| |
| ===== Definition ===== | ===== Definition ===== |
| ===== Example ===== | ===== Example ===== |
| |
| A Crucible Image Baseline selects a [[private:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] for [[private:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 as the Compliance Benchmark for a Hardened Image. | A Crucible Image Baseline selects a [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] for [[public:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 as the Compliance Benchmark for a Hardened Image. |
| |
| ---- | ---- |