AU-8 Time Stamps

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	System	None

Related controls: AU-3, AU-12, AU-14, SC-45

Control statement

• a. Use internal system clocks to generate time stamps for audit records; and
• b. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.

NIST discussion

Time stamps generated by the system include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. Granularity of time measurements refers to the degree of synchronization between system clocks and reference clocks (e.g., clocks synchronizing within hundreds of milliseconds or tens of milliseconds). Organizations may define different time granularities for different system components. Time service can be critical to other security capabilities such as access control and identification and authentication, depending on the nature of the mechanisms used to support those capabilities.

Withdrawn enhancements: AU-8(1), AU-8(2).

Assessment objectives (SP 800-53A)

Objectives and methods for AU-8

Determine if:

• AU-08a. internal system clocks are used to generate timestamps for audit records;
• AU-08b. timestamps are recorded for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.

Examine: Audit and accountability policy; system security plan; privacy plan; procedures addressing timestamp generation; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records.

Interview: Organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.

Test: Mechanisms implementing timestamp generation.

Policy statement

• The System owner shall ensure the system uses internal system clocks to generate time stamps for audit records. (AU-8a)
• The System owner shall ensure audit record time stamps meet a granularity of Fill in: granularity of time measurement for audit record timestamps Typical: one second or finer and use Coordinated Universal Time, a fixed offset from it, or include the local offset in the time stamp. (AU-8b)

From the Audit and Accountability Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AU-8 asks each system to time stamp audit records from its internal clocks, to a set granularity, in Coordinated Universal Time (UTC) or with a stated offset from it. Accurate, comparable time stamps are what let an investigator put events from different components in order. NIST’s AU-8 discussion defines granularity as the degree of synchronization between system clocks and reference clocks, and allows different granularities for different components.

Common implementations. Every component synchronizes its clock with the Network Time Protocol (NTP) or an equivalent, using the organization’s internal time servers or the cloud provider’s time service, which in turn follow an authoritative source. Records use UTC, or an ISO 8601 time stamp that includes the offset. The log platform flags components whose clocks drift or that are not synchronized. Clock synchronization itself is SC-45, which is in no baseline.

Organization-defined parameters. Typical value, which your organization may set differently:

Parameter	Typical value
Granularity of time measurement (b)	One second or finer

In the Audit and Accountability policy, the system owner ensures time stamps use internal clocks, meet this granularity and use UTC or a stated offset. The system monitoring standard requires every log source to use a common time source.

Evidence assessors ask for.

• Time synchronization settings on a sample of components, and the time sources they use
• Sample records from each type of component, showing the time stamp format and offset
• Drift or synchronization monitoring, with any recent exceptions

Inheritance. Time servers and cloud time services are usually common controls. The system owns configuring its components to use them and its applications’ time stamp format, so AU-8 is usually a hybrid control.

Common findings.

• Components logging local time with no offset, so events jump an hour at daylight saving changes.
• Network appliances or hypervisors never pointed at the time servers, drifting by minutes.
• Application records that use a time stamp format the log platform misreads.
• Records whose time comes from the log platform’s receipt instead of the component’s clock.

Enhancements in the Moderate baseline. AU-8 has no enhancements in effect; AU-8(1) and AU-8(2) were withdrawn and moved to SC-45(1) and SC-45(2).

Federal systems (as of September 2026). OMB M-26-14 (May 22, 2026), Appendix B item 3, requires logs to include a consistently accurate time stamp. Network time must be synchronized with NTP or an equivalent to a traceable time source the agency designates, and agencies are encouraged to use sources traceable to the U.S. Naval Observatory or NIST where feasible. The system monitoring standard’s federal block carries this requirement. M-26-14 does not apply to national security systems.

Artifacts

• Audit and Accountability Decision Worksheet
• Audit and Accountability Policy
• Audit Logging Standard