CCI-000166

The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Implementation Guidance

The organization being inspected/assessed configures the information system to protect against an individual falsely denying having performed actions to be covered by non-repudiation defined in DoDI 8520.02 and DoDI 8520.03. DoDI 8520.02 and DoDI 8520.03 meet the DoD requirement to define the actions to be covered by non-repudiation. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 166.

Validation Procedures

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed protects against an individual falsely denying having performed actions to be covered by non-repudiation defined in DoDI 8520.02 and DoDI 8520.03. DoDI 8520.02 and DoDI 8520.03 meet the DoD requirement to define the actions to be covered by non-repudiation. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 166.

Compelling Evidence

1.) Signed and dated audit and accountability policy

The controls below (if any) were marked by NIST as being related to CCI-000166.