Non-repudiation

PCIComplianceHubLast updated

The assurance that a party cannot deny the authenticity of their actions or the validity of a message or transaction. In the context of PCI DSS, non-repudiation can be important for proving the legitimacy of transactions and ensuring the accountability of parties involved in processing cardholder data.

Applies to. PCI DSS v4.0.1 does not use the term. The nearest it comes is accountability: Requirement 8's unique user IDs let an action be tied to one person, and Requirement 10's protected audit logs record what that person did, which gives an assessor attribution but not the cryptographic proof that non-repudiation strictly means, and the standard does not require digital signatures. Whether a cardholder can deny a transaction is settled by the payment brands' dispute rules and by EMV and 3-D Secure, not by PCI DSS.
Related. Digital Signature, Audit Log / Audit Trail, Integrity, User Identification
Sources. PCI DSS v4.0.1 (June 2024)