An urgently needed spare part is ordered electronically. After a week, purchasing complains that the delivery never arrived — meanwhile the production stoppage has caused significant costs. The supplier denies ever having received an order. Without a delivery receipt or digital signature, it is one word against another.
Repudiation of actions (G 0.37) concerns a protection goal that often takes a back seat to confidentiality, integrity and availability: accountability. In English-speaking contexts this principle is called non-repudiation — the inability to deny actions.
What’s behind it?
People may deny having carried out certain actions for different reasons — because the actions violate instructions, to cover up mistakes, or because contractual obligations are deliberately disputed. Without technical and organisational mechanisms to ensure non-repudiation, there is no robust evidence.
Forms of repudiation
- Repudiation of origin — A person denies having sent an order, instruction or approval.
- Repudiation of receipt — A person claims never to have received an invoice, reminder or notification.
- Repudiation of a system action — A person denies having executed a specific transaction, modified a document or changed a configuration.
Impact
The consequences mainly affect commercial and legal relationships. If an order cannot be proven, suppliers may refuse or delay deliveries. If an approval cannot be documented, the approval process stalls. In financial transactions, repudiation can lead to monetary losses. In legal disputes the outcome often depends on whether an action can be verifiably assigned to a specific person.
Practical examples
Order without delivery confirmation. A company orders a component electronically from a supplier. The order is sent by email without a digital signature and without a delivery receipt. When the delivery fails to arrive, the supplier denies receiving the order. The production stoppage causes costs for which neither side has contractual protection.
Cancelled approval in a procurement workflow. In a procurement system, a department head approves an investment. When the costs exceed the planned amount, he claims never to have granted the approval. Because the system records only a simple user login as evidence rather than a digital signature, the action cannot be unambiguously assigned to him — the login could have been performed by a colleague who knew the password.
Manipulated audit trail. A system administrator makes an unauthorised configuration change and then deletes the corresponding entries from the local log. Because the logs are stored only locally and the administrator has write permissions to the log files, his action cannot be proven.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 37 mapped controls below in the section “ISO 27001 Controls Covering This Threat”.)
Prevention:
- A.8.15 — Logging: Centralised, tamper-resistant logging of all security-relevant actions.
- A.5.37 — Documented operating procedures: Clear processes for approvals, authorisations and transactions with a traceable audit trail.
- A.8.17 — Clock synchronisation: Synchronised timestamps enable unambiguous temporal assignment of actions.
- A.5.3 — Segregation of duties: Separating functions prevents one person from both performing actions and manipulating their logging.
Detection:
- A.8.16 — Monitoring activities: Monitoring detects deletion or manipulation of log data.
- A.7.4 — Physical security monitoring: Video surveillance as supplementary evidence for physical actions.
Response:
- A.5.24 — Information security incident management planning and preparation: Forensic preservation of evidence when actions are suspected of being repudiated.
- A.6.4 — Disciplinary process: Consequences when repudiation of security-relevant actions is proven.
BSI IT-Grundschutz
The BSI IT-Grundschutz catalogue links G 0.37 with the following modules:
- OPS.1.1.5 (Logging) — requirements for complete, tamper-resistant logging.
- OPS.1.1.2 (Proper IT administration) — traceability of administrative actions.
- DER.1 (Detecting security-relevant events) — detection of attempts to manipulate log data.
- ORP.4 (Identity and access management) — personalised accounts as the basis for assigning actions.
Sources
- BSI: The State of IT Security in Germany — annual report referencing evidence obligations and logging
- BSI IT-Grundschutz: Elementary Threats, G 0.37 — original description of the elementary threat
- ISO/IEC 27002:2022 Section 8.15 — implementation guidance on logging