public:99_annexes:annex-b-terms-and-definitions:c:compliance_provider

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:99_annexes:annex-b-terms-and-definitions:c:compliance_provider [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1public:99_annexes:annex-b-terms-and-definitions:c:compliance_provider [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== Compliance Provider ======
  
 +[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 +
 +===== Discussion =====
 +
 +A Compliance Provider is a software component or service that performs compliance-related operations through a defined provider-independent contract.
 +
 +The Compliance Provider may select or invoke assessment tooling, process machine-readable benchmarks, execute checks, apply remediation, parse native results, and transform those results into a common findings representation.
 +
 +A Compliance Provider isolates scanner-specific commands, formats, terminology, and behavior from the compliance functions that consume normalized results and generate evidence.
 +
 +Within Crucible, an OpenSCAP Compliance Provider invokes OpenSCAP, processes the resulting assessment content, and supplies normalized findings to the compliance engine.
 +
 +===== Definition =====
 +
 +//software component or service that performs compliance-related operations through a defined provider-independent contract//
 +
 +===== Source =====
 +
 +Generalized from provider abstraction, plugin architecture, compliance automation, scanner integration, and software-adapter usage and specialized for the Crucible architecture and operational model.
 +
 +===== Note =====
 +
 +A Compliance Provider is not the authority that establishes the applicable compliance criteria or grants accreditation or operational approval.
 +
 +Different Compliance Providers may support different benchmarks, scanners, operating systems, result formats, or remediation mechanisms while conforming to the same provider-independent contract.
 +
 +===== Example =====
 +
 +A Crucible Compliance Provider invokes OpenSCAP to assess a [[public:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 Hardened Image against a selected [[public:99_annexes:annex-b-terms-and-definitions:s:stig|Security Technical Implementation Guide (STIG)]] profile and converts the native results into normalized findings.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>