QILAHK™ / TRUST CONTINUITY
Evidence Has a Time Boundary
Set revalidation rules that reflect how quickly the assessed conditions can change.
· QILAHK Journal
Time belongs in the claim
Evidence establishes an observation within a context and time boundary. A configuration collected yesterday may describe yesterday accurately while leaving today’s state unestablished. The more changeable the property, the more significant that distinction becomes.
A trust record should identify when the observation occurred, when it was received, and when the decision was made. These times can differ, particularly when collection happens offline or artifacts are submitted later.
Set freshness by relevance
Freshness requirements should follow the claim and the environment. A rapidly changing authorization may need frequent reassessment. A more stable asset attribute may justify a different interval, while still requiring review when a relevant event occurs.
Avoid assigning one expiration period to every evidence type simply for convenience. Record the basis for each interval and the events that can make an observation stale before its scheduled expiry.
Combine schedules with events
A scheduled revalidation provides a predictable review point. Event-triggered review addresses significant changes between those points, such as an identity change, software replacement, policy revision, or loss of a required evidence source.
Neither approach removes the need to know whether collection actually occurred. A monitoring schedule and a successful observation are separate records. Missed collection should be visible to the reviewer.
Handle the gap explicitly
When required evidence is stale, document which claim can no longer be established at the needed time. Apply the governing workflow for further collection, limited reliance, or a status change. The outcome should follow policy and authorized judgment.
A practical revalidation plan specifies the property, acceptable observation age, triggering events, collector, responsible reviewer, and response to missing evidence. This turns freshness from an implicit assumption into an operational condition that can be checked.
Continue exploring the foundations in Cybersecurity Has Security Controls. What It Lacks Is a Trust Layer.
← Back to the Trust Authority Blog