SUPPORTED EVIDENCETESTEDLast reviewed: 2026-07-01

AU-3: Ensure audit records contain sufficient information to establish what occurred, when, where, source, outcome, and identity

Vallum evidence mapping for NIST SP 800-53 AU-3 — ensure audit records contain sufficient information to establish what occurred, when, where, source, outcome, and identity. This page documents what evidence Vallum produces, what it does not produce, and what remains the customer's responsibility.

Source Attribution

Framework: NIST SP 800-53 Rev 5
Control ID: AU-3
Source Organization: NIST
Official Source: NIST SP 800-53 Rev 5 ↗
Control Objective: Ensure audit records contain sufficient information to establish what occurred, when, where, source, outcome, and identity

Evidence Vallum Produces

Timestamped audit receipts, evidence packages with cryptographic integrity, signed audit summaries, and retention-compliant archives

Evidence Vallum Does NOT Produce

Application-level business logic logs, third-party system audit trails, or infrastructure monitoring data

Known Limitations

Vallum produces evidence relevant to this control but does not enforce the control at the infrastructure, network, or operating-system level. Evidence covers Vallum-managed operations only. Customer systems, third-party integrations, and infrastructure controls require separate evidence sources.

Your Responsibilities

Configure retention periods, integrate Vallum audit data with organizational SIEM, establish review procedures, and maintain audit infrastructure

External Controls Required

Identity provider (IdP), network firewall and segmentation, infrastructure monitoring, endpoint protection, and organizational security policies

Residual Risk

Vallum evidence covers authorization and evidence-layer operations. Gaps exist at infrastructure, network, and physical layers that require complementary controls. Time-of-check to time-of-use windows exist between evidence capture and verification.

Relevant Titan Components

Titan VerifyTitan Sign