DoDI 8520.02 and DoDI 8520.03 meet the DoD requirement to define the actions to be covered by non-repudiation. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 166. AU-10 AU-10 High The organization being Automatically Moderate inspected/assessed is compliant automatically compliant with this CCI with this CCI because they because they are covered at the DoD are covered at level. the DoD level DoD has defined the actions to be covered by non-repudiation as actions defined by DoDI 8520.02 and DoDI 8520.03. AU-10 AU-10 (1) blank blank blank The organization NIST has not (a) conducting the allocated this (1) inspection/assessment AP. Therefore, obtains and examines the this AP is not documented strength of applicable. binding to ensure the organization being inspected/assessed defines the strength of binding and where within the information system it has been implemented, to be applied to the binding of the identity of the information producer with the information. DoD has determined that the strength of binding is not appropriate to define at the Enterprise level. AU-10 AU-10 (1) blank blank blank The organization NIST has not (1) (a) conducting the allocated this
DoDI 8520.02 and DoDI 8520.03 meet the DoD requirement to define the actions to be covered by non-repudiation. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 166. AU-10 AU-10 High Moderate The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the actions to be covered by non-repudiation as actions defined by DoDI 8520.02 and DoDI 8520.03. Automatically compliant with this CCI because they are covered at the DoD level AU-10 (1) AU-10 (1) (a) blank blank blank The organization conducting the inspection/assessment obtains and examines the documented strength of binding to ensure the organization being inspected/assessed defines the strength of binding and where within the information system it has been implemented, to be applied to the binding of the identity of the information producer with the information. DoD has determined that the strength of binding is not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. AU-10 (1) AU-10 (1) (a) blank blank blank The organization conducting the NIST has not allocated this
RMF_Audit-and-Accountability-Plan.docx