Contra-indicators

What the clause says

A contra-indicator is evidence that calls an age attribute into question. It can sit with the person, such as conflicting records, or with the system, such as an attack.

What it supplies to a comparison

Contra-indicator handling is a comparison line in its own right. A system that never finds one may be blind rather than clean.

Evidence to keep

• The detection rules and the escalation route.
• A sample of resolved and unresolved contra-indicators.

What the evidence looks like

For 9.3, the first artefact is The detection rules and the escalation route.. The second is A sample of resolved and unresolved contra-indicators.. If 9.3 has no first artefact, the practice is unproven at 9.3, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. What happens when a contra-indicator fires?
2. How many fire in normal operation, and is that number plausible?

How it connects to the draft

Contra-indicators belongs to 9 attacks and contra-indicators, and it gives the analysis one fixed point: Contra-indicator handling is a comparison line in its own right. A system that never finds one may be blind rather than clean. A comparison that cannot place a result against 9.3 is measuring something the framework has not defined, and the report should say so.

In the register, 9.3 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.