A log line that says "error" is not an audit record. AU-3 says what a record must contain so someone can use it months later.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. For other organizations it is a reference.
What the control asks
Audit records must contain information that establishes six things: what type of event occurred, when it occurred, where it occurred, the source of the event, the outcome, and the identity of any individuals, subjects or objects associated with the event.
What it means in practice
NIST's guidance maps those to familiar fields: event descriptions, time stamps, source and destination addresses, user or process identifiers, success or failure indicators and file names involved. Outcomes include success or failure and event specific results.
A good check is to take one real record and answer the six questions from it alone. Who signed in? From which address? To what system? Did it work?
There is a privacy note as well. Records can reveal personal information, so the guidance asks organizations to consider the risk and limit what is stored. The enhancement AU-3.3 Limit Personally Identifiable Information Elements covers this. AU-3.1 Additional Audit Information and AU-3.2 Centralized Management of Planned Audit Record Content are the other two enhancements.
Evidence to collect
- Sample records from each key system with the six elements highlighted.
- Your log format standard, if you have one.
- A note on which fields are masked or excluded for privacy.
- Configuration showing the fields are enabled.
Common gaps
- Missing user identity on service actions.
- No outcome field, so failed and successful actions look alike.
- Times without a zone.
- Passwords or tokens written into logs.
How to implement it
Define a minimum log schema, enforce it in a shared logging library, and test samples from each service.
Quick check
Is a user id enough for the "identity" element?
For people, usually yes if it maps back to a real person. For automated actions, record the service or process identity as well.
