Authentication, Authorization, Accounting, and Non-Repudiation
Key Takeaways
Subdomain 1.1 names Authentication, Authorization, Accounting (AAA) and non-repudiation as cybersecurity concepts.
Authentication checks identity, authorization decides what that identity may do, and accounting records what it did.
Non-repudiation means a party cannot credibly deny an action it performed.
Shared accounts weaken accounting, because the record no longer identifies one person.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 1.1, checked 2026-10-22.
AAA in Order
The outline lists Authentication, Authorization, Accounting (AAA) as one concept. In an access decision they occur in order. Authentication establishes who or what is asking. Authorization decides what that identity is allowed to do. Accounting records what happened, so it can be reviewed later.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 1.1, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Non-Repudiation and Accountability
Non-repudiation means an action can be attributed to a party, which that party cannot credibly deny. It depends on the same chain: the identity was verified, the action was authorized, and the record ties the action to that identity.
Shared administrator accounts break the chain. Several people use one identity, so the accounting record shows the account, not the person. A scenario with a shared account is therefore a non-repudiation problem, even when the access itself was allowed.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 1.1: Confidentiality
- 1.1: Integrity
- 1.1: Availability
- 1.1: Authentication, Authorization, Accounting (AAA)
- 1.1: Non-repudiation
- 1.1: Privacy
Common Traps
A common trap is naming the wrong objective. If the scenario is about who acted, the objective is accountability, not availability. Name the objective the scenario states before choosing among controls.
Why are shared administrator accounts a poor security practice?
They break accounting, because actions cannot be attributed to one person
They always grant too little access to finish the assigned work at all, even for simple routine tasks
They prevent authentication from being checked at all in the system, even when a password is entered each time
They remove the need for any authorization decision in the system at all
Order these concepts as they normally occur in an access decision.
Arrange the items in the correct order
Authorization of the requested action
Accounting of the action
Authentication of the requester
Sections you finish are checked off in the contents.