AU-08 Time Stamps
All changes in this version
Title
Time Stamps
Control
a. Use internal system clocks to generate time stamps for audit records; and
b. Record time stamps for audit records that meet [Assignment: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
Discussion
Time stamps generated by the system include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. Granularity of time measurements refers to the degree of synchronization between system clocks and reference clocks (e.g., clocks synchronizing within hundreds of milliseconds or tens of milliseconds). Organizations may define different time granularities for different system components. Time service can be critical to other security capabilities such as access control and identification and authentication, depending on the nature of the mechanisms used to support those capabilities.
Parameters
au-08_odp: granularity of time measurement
Related controls
au-12, au-14, au-3, sc-45
STIG rules that implement this control 14
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001003 CAT II The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001003 CAT II The macOS system must enable security auditing.
Application Security and Development V6R5
- APSC-DV-001250 CAT II The applications must use internal system clocks to generate time stamps for audit records.
- APSC-DV-001260 CAT II The application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
- APSC-DV-001270 CAT II The application must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-252020 CAT III Ubuntu 22.04 LTS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-901220 CAT III Ubuntu 24.04 LTS must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
Cisco IOS XE Router NDM Y26M04
- CISC-ND-001030 CAT II The Cisco router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
- RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
- RHEL-10-800040 CAT II RHEL 10 must securely compare internal information system clocks at least every 24 hours.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-252020 CAT II RHEL 9 must securely compare internal information system clocks at least every 24 hours.
- RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
- RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.