R — Repudiation

Repudiation is when actions can't be reliably traced—so someone can deny what they did. Accountability is the target.

What it means

Repudiation is when a user can deny actions because the system can't prove who did what, and when.

If you can't trace actions, investigations and incident response become guesswork. Trust and accountability collapse.

Use reliable audit logs: who, what, when, where. Protect logs from tampering, and include request IDs and server-side timestamps.

Not solved

Every action on this page is logged below.

Mission: perform an action — then remove the evidence.

An administrator deletes a customer account. Later, they deny ever doing it. There is no audit log entry for the deletion.

Not solved

What failed in this system?

A user performs a transfer. Later, they edit the log file and remove the entry. The system has no way to detect that logs were changed.

Not solved

What control is missing?