| Both sides previous revision Previous revision | |
| public:99_annexes:annex-b-terms-and-definitions:c:compliance_posture [2026/09/12 17:42] – ↷ Page moved from private:99_annexes:annex-b-terms-and-definitions:c:compliance_posture to public:99_annexes:annex-b-terms-and-definitions:c:compliance_posture nick_dido | public:99_annexes:annex-b-terms-and-definitions:c:compliance_posture [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido |
|---|
| ====== Compliance Posture ====== | ====== Compliance Posture ====== |
| |
| [[private:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] | [[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] |
| |
| ===== Discussion ===== | ===== Discussion ===== |
| A Compliance Posture is the defined set of compliance conditions, expectations, criteria, assessment settings, remediation policy, and evidence obligations applicable to a system, artifact, environment, service, or process. | A Compliance Posture is the defined set of compliance conditions, expectations, criteria, assessment settings, remediation policy, and evidence obligations applicable to a system, artifact, environment, service, or process. |
| |
| The posture identifies what compliance means for the applicable subject and operating context. It may identify a [[private:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark|Compliance Benchmark]], selected profile, tailoring decisions, remediation setting, assessment stage, accepted exceptions, and required evidence. | The posture identifies what compliance means for the applicable subject and operating context. It may identify a [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark|Compliance Benchmark]], selected profile, tailoring decisions, remediation setting, assessment stage, accepted exceptions, and required evidence. |
| |
| A Compliance Posture may be declared before an assessment and evaluated after implementation. The declared posture states the applicable expectations, while the assessed posture reflects the resulting findings and evidence. | A Compliance Posture may be declared before an assessment and evaluated after implementation. The declared posture states the applicable expectations, while the assessed posture reflects the resulting findings and evidence. |
| |
| Within Crucible, a [[private:99_annexes:annex-b-terms-and-definitions:c:crucible_description|Crucible Description]], image definition, or [[private:99_annexes:annex-b-terms-and-definitions:b:baseline_composition|Baseline Composition]] may identify the Compliance Posture applied during an Image Build. | Within Crucible, a [[public:99_annexes:annex-b-terms-and-definitions:c:crucible_description|Crucible Description]], image definition, or [[public:99_annexes:annex-b-terms-and-definitions:b:baseline_composition|Baseline Composition]] may identify the Compliance Posture applied during an Image Build. |
| |
| ===== Definition ===== | ===== Definition ===== |
| ===== Note ===== | ===== Note ===== |
| |
| A Compliance Posture differs from a [[private:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]. The Compliance Posture describes the applicable compliance expectations and conditions. The Compliance Baseline identifies the approved configuration of criteria, profiles, controls, settings, and evidence requirements used as the controlled reference. | A Compliance Posture differs from a [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline|Compliance Baseline]]. The Compliance Posture describes the applicable compliance expectations and conditions. The Compliance Baseline identifies the approved configuration of criteria, profiles, controls, settings, and evidence requirements used as the controlled reference. |
| |
| A declared Compliance Posture does not establish that the subject satisfies the declared criteria. | A declared Compliance Posture does not establish that the subject satisfies the declared criteria. |
| ===== Example ===== | ===== Example ===== |
| |
| A Crucible Description declares a Compliance Posture that selects a [[private:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] for [[private:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9, enables remediation, requires pre-remediation and post-remediation scans, and requires preservation of the resulting evidence. | A Crucible Description declares a Compliance Posture that selects a [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] for [[public:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9, enables remediation, requires pre-remediation and post-remediation scans, and requires preservation of the resulting evidence. |
| |
| ---- | ---- |