Qledger — Compliance Evidence

NIST — 2/4 controls satisfied

	Control	Name	Evidence
✅	AU-2	Audit Events	Qledger captures all TLS connection events including PQC status, policy enforcement actions, and blocked connections.
✅	AU-3	Content of Audit Records	Each entry contains: unique ID, timestamp, source system, action type, structured payload, chain hash, and ML-DSA-65 signature.
❌	AU-9	Protection of Audit Information	Entries are SHA3-256 hash-chained and signed with ML-DSA-65 (FIPS 204). Any modification to any entry breaks the chain and is immediately detectable. Signatures are quantum-safe - cannot be forged even with a quantum computer.
❌	AU-10	Non-Repudiation	Every entry is cryptographically signed with a node-specific ML-DSA-65 key. Actions cannot be denied or repudiated - the signature proves what happened, when, and that the record is unchanged.

	Control	Name	Evidence
❌	AU.2.041	Protect Audit Logs	Entries are SHA3-256 hash-chained and signed with ML-DSA-65 (FIPS 204). Any modification to any entry breaks the chain and is immediately detectable. Signatures are quantum-safe - cannot be forged even with a quantum computer.
✅	AU.2.042	Create and Retain Audit Logs	Qledger captures all TLS connection events including PQC status, policy enforcement actions, and blocked connections.

	Control	Name	Evidence
✅	164.312(b)	Audit Controls	Qledger captures all TLS connection events including PQC status, policy enforcement actions, and blocked connections.