Detection of collusion

What the clause says

The system should detect patterns in which people cooperate to defeat the assurance, such as one person supplying a credential for another.

What it supplies to a comparison

Collusion is hard to see in a single transaction. The comparison should ask what pattern detection exists and how it is tested.

Evidence to keep

• The pattern rules and their false positive rate.
• A test scenario with a cooperative pair.

What the evidence looks like

For 8.1.2, the first artefact is The pattern rules and their false positive rate.. The second is A test scenario with a cooperative pair.. If 8.1.2 has no first artefact, the practice is unproven at 8.1.2, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. What pattern would indicate collusion in this system?
2. How many legitimate users would the rule flag?

How it connects to the draft

Detection of collusion belongs to 8 security objectives, and it gives the analysis one fixed point: Collusion is hard to see in a single transaction. The comparison should ask what pattern detection exists and how it is tested. A comparison that cannot place a result against 8.1.2 is measuring something the framework has not defined, and the report should say so.

In the register, 8.1.2 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.