public:99_annexes:annex-b-terms-and-definitions:c:compliance_profile

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:99_annexes:annex-b-terms-and-definitions:c:compliance_profile [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1public:99_annexes:annex-b-terms-and-definitions:c:compliance_profile [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== Compliance Profile ======
  
 +[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 +
 +===== Discussion =====
 +
 +A Compliance Profile is a defined selection, specialization, or tailoring of compliance criteria from one or more [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_benchmark|Compliance Benchmarks]] for a specified subject, purpose, or operating context.
 +
 +The profile identifies which criteria apply and may also identify parameter values, implementation expectations, assessment procedures, exceptions, severity assignments, or remediation guidance.
 +
 +A Compliance Profile allows a broad benchmark to support different technologies, missions, environments, assurance levels, or organizational requirements without treating every criterion as universally applicable.
 +
 +Within Crucible, the Compliance Profile helps determine which checks and remediation content apply to a particular operating system, image role, or deployment context.
 +
 +===== Definition =====
 +
 +//defined selection, specialization, or tailoring of compliance criteria from one or more compliance benchmarks for a specified subject, purpose, or operating context//
 +
 +===== Source =====
 +
 +Generalized from conformity assessment, security configuration, control tailoring, policy profiling, and machine-processable compliance content and specialized for the Crucible architecture and operational model.
 +
 +===== Note =====
 +
 +A Compliance Profile should identify its source benchmark, version, applicability, selected criteria, parameters, and tailoring decisions.
 +
 +Selecting a Compliance Profile does not establish that the evaluated subject satisfies the selected criteria.
 +
 +===== Example =====
 +
 +A [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] data stream contains a Compliance Profile for [[public:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9. Crucible selects that profile when assessing the corresponding Hardened Image.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>