6.7.4 Non-repudiation measures

What this heading covers

The proof usually rests on a signature, a sealed log or a trusted timestamp, and the measure is about coverage and verifiability. A log that the actor can edit is not non-repudiation evidence. The population is the set of actions where a dispute is plausible: approvals, payments, submissions, deletions. The measure should be tested by trying to deny an action and checking whether the record settles it.

Record position: family 23 of 40 in clause 6, under 6.7 Security, which carries 6 families. It is one of the 40 families a programme has to map its measures to, and its elements are listed below. The heading is 6.7.4 in the public contents; the text behind it is not public.

How a measure for this family is built

Count the actions in scope that carry verifiable evidence as the numerator over the actions in scope. Add a test measure: the number of simulated disputes resolved by the evidence over the disputes raised. Record the verification method and who holds the key.

What to put in place before publication

1. List the actions where denial would matter.
2. Test a denial, not only the presence of a log entry.

Evidence to keep

Two questions to ask

• Can the actor alter the evidence, and who holds the key?
• Has a simulated denial been resolved by the record?

Where teams usually fall short

• An application log with no tamper protection, cited as non-repudiation.

What the number cannot tell you

It cannot tell you whether the evidence is admissible in a particular forum. It tells you whether the record is capable of settling a denial.

What happens next

Accountability is about attributing an action even when nobody denies it.