If two systems disagree about the time, you cannot say which event came first. AU-8 exists so your timeline holds up.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. For everyone else it is a reference.
What the control asks
Use internal system clocks to generate time stamps for audit records. Record time stamps that meet a granularity you define and that use Coordinated Universal Time, have a fixed local time offset from UTC, or include the local offset in the stamp itself.
NIST's guidance adds that time service can be critical to other security capabilities, such as access control and authentication. The enhancements AU-8.1 Synchronization with Authoritative Time Source and AU-8.2 Secondary Authoritative Time Source address clock sync.
What it means in practice
Use UTC everywhere, or always include the offset. Sync every host and service to a trusted time source, and check that they stay in sync.
Evidence to collect
- Time sync configuration for servers, containers and managed services.
- Sample log lines showing UTC or offsets.
- Monitoring output for clock drift.
- Your defined granularity.
Common gaps
- Local times with no zone.
- Appliances left on default clocks.
- No drift monitoring.
How to implement it
Standardize on UTC, configure NTP or your cloud provider's time service, and alert on drift.
