Time Stamps AU-8
Audit and Accountability · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds AU-8 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
AU-8 (Time Stamps) is about making sure every log entry carries an accurate, consistent time. If the clock is wrong or drifts, you cannot line up events across systems or trust the order of what happened. It is an Audit and Accountability control in the Low baseline.
What good looks like
- Stamp every audit record from the system clock, at a fine enough granularity (at least to the second) to tell events apart.
- Keep the clock accurate by syncing to a trusted time source.
- Record time in UTC (Coordinated Universal Time), or with a clear offset from UTC, so a timestamp means the same thing everywhere.
- Make sure all your systems share the same time source so their logs can be lined up.
- Watch for clock drift so a slow or fast clock does not corrupt your timeline.
Framework mapping
- CIS Controls v8 — Control 8 — Audit Log Management
How to move it toward Implemented
- Check the clock and sync status:
timedatectl status(look for ‘System clock synchronized: yes’). - Enable network time sync:
timedatectl set-ntp true, or configurechronyin/etc/chrony/chrony.confto point at a trusted time server. - Set the server to record in UTC (
timedatectl set-timezone UTC) so logs across machines line up without offset math. - Attach the
timedatectloutput as hardening evidence on the asset, namingAU-8in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.