Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

au-8

time stamps

assessment objective:

Determine if:

au-8(a)

the information system uses internal system clocks to generate time stamps for audit records;

au-8(b)

au-8(b)[1]

the information system records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT);

au-8(b)[2]

the organization defines the granularity of time measurement to be met when recording time stamps for audit records; and

au-8(b)[3]

the organization records time stamps for audit records that meet the organization-defined granularity of time measurement.

potential assessment methods and objects:

Examine: [select from: Audit and accountability policy; procedures addressing time stamp generation; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with information security responsibilities; system/network administrators; system developers].

Test: [select from: Automated mechanisms implementing time stamp generation].