public:99_annexes:annex-b-terms-and-definitions:c:compliance_finding

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:99_annexes:annex-b-terms-and-definitions:c:compliance_finding [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1public:99_annexes:annex-b-terms-and-definitions:c:compliance_finding [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== Compliance Finding ======
  
 +[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 +
 +===== Discussion =====
 +
 +A Compliance Finding is a recorded result produced by evaluating a specified subject against an applicable compliance criterion.
 +
 +The finding may record satisfaction, non-satisfaction, non-applicability, inability to determine, execution error, or another result permitted by the applicable assessment method.
 +
 +A Compliance Finding may identify the evaluated criterion, subject, benchmark and profile versions, assessment time, method, observed value, expected value, severity, rationale, remediation information, and supporting [[public:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]].
 +
 +Within Crucible, a Compliance Provider may produce scanner-specific findings that the compliance engine transforms into a common or normalized findings representation.
 +
 +===== Definition =====
 +
 +//recorded result produced by evaluating a specified subject against an applicable compliance criterion//
 +
 +===== Source =====
 +
 +Generalized from conformity assessment, security assessment, audit, control evaluation, and compliance-scanning usage and specialized for the Crucible architecture and operational model.
 +
 +===== Note =====
 +
 +A Compliance Finding records the result for a single criterion or a bounded evaluation. A collection of Compliance Findings supports a broader determination of compliance.
 +
 +A finding of non-satisfaction does not by itself determine the acceptability of the associated risk. The applicable governance and authorization process evaluates the finding, context, remediation, exceptions, and residual risk.
 +
 +===== Example =====
 +
 +An assessment evaluates a [[public:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 Machine Image against a [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] rule requiring a specified audit configuration. The resulting Compliance Finding records whether the image satisfies the rule and preserves the observed configuration and supporting evidence.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>