Non-repudiation AU-10

Audit and Accountability · High baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AU-10 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AU-10 (Non-repudiation) is about proving, beyond honest dispute, that a specific person (or a process acting for them) actually did a specific action — so they cannot credibly deny it later. It is a strong Audit and Accountability control, which is why it lives in the High baseline. On a Linux server it leans on unique identities and tamper-evident logs.

What good looks like

Tie every action to a unique, named identity — no shared or generic accounts, or you cannot prove who did what.
Capture who, what, and when for the actions that matter, in a log that is hard to alter after the fact.
Protect the logs so they are tamper-evident — a change should be detectable, not silent.
Where the stakes are highest, use signatures or hashes so a record can be proven authentic.
Keep the evidence long enough to settle a dispute, per your retention policy.

Framework mapping

How to move it toward Implemented

Enforce unique logins and forbid shared accounts; require sudo so privileged actions are attributed to a real user in /var/log/auth.log.
Turn on the audit daemon (auditd) and add rules with auditctl (or files under /etc/audit/rules.d/) to record the sensitive actions you must be able to prove.
Make logs tamper-evident: forward them to a separate host in real time, or hash and sign archived logs so alteration is detectable.
Attach the audit rules and a sample attributed log entry as hardening evidence on the asset, naming AU-10 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.