Attack and contra-indicator analysis

What the clause says

The framework treats attacks and contra-indicators as a system concern. The provider should look for evidence that the attribute may be wrong, not only for evidence that it is right.

What it supplies to a comparison

This is the question a comparison asks after the accuracy test: what would this system miss, and how would it know?

Evidence to keep

• The contra-indicator list and the action taken on each.
• The attack scenarios considered and the ones excluded.

What the evidence looks like

For 9.1, the first artefact is The contra-indicator list and the action taken on each.. The second is The attack scenarios considered and the ones excluded.. If 9.1 has no first artefact, the practice is unproven at 9.1, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. What contra-indicators does the system act on?
2. Which known attacks are outside its threat model?

How it connects to the draft

Attack and contra-indicator analysis belongs to 9 attacks and contra-indicators, and it gives the analysis one fixed point: This is the question a comparison asks after the accuracy test: what would this system miss, and how would it know?. A comparison that cannot place a result against 9.1 is measuring something the framework has not defined, and the report should say so.

In the register, 9.1 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.