AU-08 Time Stamps

Last modified: May 22, 2026

Introduction

This document describes how Private Mendix Platform fulfills the AU-08 control.

Control ID AU-08
Requirement baseline FEDRAMP MODERATE
Responsibility and ownership Mendix - Private Mendix Platform, Mendix - Operator, Mendix - Studio Pro/Runtime, Customer - Infra

Control

AU-08

The information system:

  • Uses internal system clocks to generate time stamps for audit records.
  • Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets the requirements for the organization-defined granularity of time measurement.

AU-08 (01)

The information system:

  • Compares the internal information system clocks with an organization-defined authoritative time source at an organization-defined frequency.
  • Synchronizes the internal system clocks to the authoritative time source when the time difference is greater than an organization-defined time period.

Supplemental Guidance

AU-08

Time stamps generated by the information system include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. Granularity of time measurements refers to the degree of synchronization between information system clocks and reference clocks, for example, clocks synchronizing within hundreds of milliseconds or within tens of milliseconds. Organizations may define different time granularities for different system components. Time service can also be critical to other security capabilities such as access control and identification and authentication, depending on the nature of the mechanisms used to support those capabilities.

The following controls are related to this control:

  • AU-3
  • AU-12

AU-08 (01)

This control enhancement provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.

Responsibility

Mendix Responsibility

  • The Mendix Operator, Mendix Runtime, and Private Mendix Platform can create audit record timestamps based upon the system clock, and all timestamps can be converted to UTC.
  • Private Mendix Platform can display and archive logs with timestamps containing the UTC offset.

Customer Responsibility

The customer is responsible for configuring the output for logged timestamps in the customer's preferred time zone.

Guidance

Mendix Responsibility

  • Private Mendix Platform provides a Create Custom Report on the Customer Admin > Manage > (Platform) > Activity Log page, including the following settings:

    • The ability to configure the output for logged timestamps in customer preferred time zone.

  • Private Mendix Platform stores log timestamps in a database to a maximum granularity in milliseconds.

  • Private Mendix Platform displays and archives logs with timestamps containing the UTC offset in the customer-preferred time zone.

Customer Responsibility

The customer is responsible configure the output for logged timestamps in the customer-preferred time zone.

Proof and Remarks

Private Mendix Platform provides a setting to configure the output for logged timestamps in a customer-preferred time zone:

Private Mendix Platform displays logs with timestamps in milliseconds and the UTC offset (-04:00) in the customer-preferred time zone: