Non-repudiation sounds abstract. In practice it answers a simple dispute: "I never approved that." AU-10 asks you to be able to prove who did what.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. For other organizations it is a reference.
What the control asks
Provide irrefutable evidence that an individual, or a process acting for an individual, has performed actions you define. NIST's guidance says covered actions include creating information, sending and receiving messages, and approving information. It protects against authors denying authorship, senders denying they sent, receivers denying they received and signers denying they signed.
What it means in practice
Pick the actions where denial would hurt: production deployments, access approvals, policy sign offs, contract signing, financial approvals. For each, make sure you can show a verified identity, a time and a tamper resistant record.
The enhancements show techniques: AU-10.1 Association of Identities, AU-10.2 Validate Binding of Information Producer Identity, AU-10.3 Chain of Custody, AU-10.4 Validate Binding of Information Reviewer Identity and AU-10.5 Digital Signatures. Signed commits, signed release artifacts and an e-signature tool are modern examples.
Evidence to collect
- A list of actions you chose to cover and why.
- Samples of records tying an identity, a time and an action together.
- Proof of strong authentication on those actions.
- Signature or hash verification output for key artifacts.
- Audit trails from your approval tools.
Common gaps
- Shared accounts, which break the link to a person.
- Approvals made in chat with nothing durable.
- Unsigned release artifacts.
- Logs that an admin can edit, which weakens the proof.
How to implement it
Require individual accounts and multi-factor sign in for covered actions. Use signed commits or tags for releases and keep approvals inside a system that logs them immutably. Protect those logs as AU-9 describes.
Quick check
Does a chat message saying "approved" count?
Usually not. It is easy to dispute and hard to bind to a verified identity. Use a system that records the approver, time and content.
