Control statement
Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Organization-defined: actions].
Discussion
Types of individual actions covered by non-repudiation include creating information, sending and receiving messages, and approving information. Non-repudiation protects against claims by authors of not having authored certain documents, senders of not having transmitted messages, receivers of not having received messages, and signatories of not having signed documents. Non-repudiation services can be used to determine if information originated from an individual or if an individual took specific actions (e.g., sending an email, signing a contract, approving a procurement request, or receiving specific information). Organizations obtain non-repudiation services by employing various techniques or mechanisms, including digital signatures and digital message receipts.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Non-repudiation as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to audit event design, trustworthy collection, retention, review, and investigation support.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- logging standards and event-selection decisions
- sample audit records and retention settings
- time-synchronization evidence
- alert and review records
Common failure patterns
- collecting logs without defined use cases
- critical events missing from the audit trail
- retention shorter than investigative needs
- logs accessible to the same administrators being monitored
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
irrefutable evidence is provided that an individual (or process acting on behalf of an individual) has performed [Organization-defined: actions].
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- procedures addressing non-repudiation
- system design documentation
- system configuration settings and associated documentation
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- Mechanisms implementing non-repudiation capability
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Related defensive techniques
D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
AU-10(1) — Association of Identities
- (a)Bind the identity of the information producer with the information to [Organization-defined: strength of binding] ; and
- (b)Provide the means for authorized individuals to determine the identity of the producer of the information.
Official discussion
Binding identities to the information supports audit requirements that provide organizational personnel with the means to identify who produced specific information in the event of an information transfer. Organizations determine and approve the strength of attribute binding between the information producer and the information based on the security category of the information and other relevant risk factors.
Organization-defined parameters (1)
Assessment objectives and methods
- AU-10(01)(a)the identity of the information producer is bound with the information to [Organization-defined: strength of binding];
- AU-10(01)(b)the means for authorized individuals to determine the identity of the producer of the information is provided.
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- procedures addressing non-repudiation
- system design documentation
- system configuration settings and associated documentation
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- Mechanisms implementing non-repudiation capability
Related controls
AU-10(2) — Validate Binding of Information Producer Identity
- (a)Validate the binding of the information producer identity to the information at [Organization-defined: frequency] ; and
- (b)Perform [Organization-defined: actions] in the event of a validation error.
Official discussion
Validating the binding of the information producer identity to the information prevents the modification of information between production and review. The validation of bindings can be achieved by, for example, using cryptographic checksums. Organizations determine if validations are in response to user requests or generated automatically.
Organization-defined parameters (2)
Assessment objectives and methods
- AU-10(02)(a)the binding of the information producer identity to the information is validated at [Organization-defined: frequency];
- AU-10(02)(b)[Organization-defined: actions] in the event of a validation error are performed.
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- procedures addressing non-repudiation
- system design documentation
- system configuration settings and associated documentation
- validation records
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- Mechanisms implementing non-repudiation capability
Related controls
AU-10(3) — Chain of Custody
Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released.
Official discussion
Chain of custody is a process that tracks the movement of evidence through its collection, safeguarding, and analysis life cycle by documenting each individual who handled the evidence, the date and time the evidence was collected or transferred, and the purpose for the transfer. If the reviewer is a human or if the review function is automated but separate from the release or transfer function, the system associates the identity of the reviewer of the information to be released with the information and the information label. In the case of human reviews, maintaining the credentials of reviewers or releasers provides the organization with the means to identify who reviewed and released the information. In the case of automated reviews, it ensures that only approved review functions are used.
Assessment objectives and methods
reviewer or releaser credentials are maintained within the established chain of custody for information reviewed or released.
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- procedures addressing non-repudiation
- system design documentation
- system configuration settings and associated documentation
- records of information reviews and releases
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- Automated mechanisms implementing non-repudiation capability
Related controls
AU-10(4) — Validate Binding of Information Reviewer Identity
- (a)Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Organization-defined: security domains] ; and
- (b)Perform [Organization-defined: actions] in the event of a validation error.
Official discussion
Validating the binding of the information reviewer identity to the information at transfer or release points prevents the unauthorized modification of information between review and the transfer or release. The validation of bindings can be achieved by using cryptographic checksums. Organizations determine if validations are in response to user requests or generated automatically.
Organization-defined parameters (2)
Assessment objectives and methods
- AU-10(04)(a)the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Organization-defined: security domains] is validated;
- AU-10(04)(b)[Organization-defined: actions] are performed in the event of a validation error.
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- procedures addressing non-repudiation
- system design documentation
- system configuration settings and associated documentation
- validation records
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- Mechanisms implementing non-repudiation capability
Related controls
AU-10(5) — Digital Signatures
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.