Question · NIST 800-53 · AU
Which NIST 800-53 controls cover AI audit logging?
The AU family has 16 controls (AU-1 to AU-16, AU-15 withdrawn) covering which events a system logs, what each record contains, how logs are reviewed, protected, retained and made non-repudiable.
01 / The answer
The short answer
The Audit and Accountability (AU) family in SP 800-53 Rev. 5 covers logging for AI systems as for any other system; it has no AI-specific controls. The main ones are AU-2 Event Logging, AU-3 Content of Audit Records, AU-6 Audit Record Review, Analysis, and Reporting, AU-9 Protection of Audit Information, AU-10 Non-repudiation, AU-11 Audit Record Retention and AU-12 Audit Record Generation. The CA family covers assessment and continuous monitoring. NIST's AI control overlays, renamed Control Overlays for Super Intelligence Systems on October 20, 2026, have no public draft yet.
02 / The rule
What NIST 800-53 · AU requires
The AU family has 16 controls (AU-1 to AU-16, AU-15 withdrawn) covering which events a system logs, what each record contains, how logs are reviewed, protected, retained and made non-repudiable. For AI systems inside a federal boundary it is the baseline for logging model use, administrative actions and outputs so incidents can be investigated later.
- 01Select the event types the system logs, with a rationale that they support after-the-fact incident investigation (AU-2).
- 02Make each audit record show what happened, when, where, the source, the outcome and the identities involved (AU-3).
- 03Review and analyze audit records for unusual activity and report findings to designated officials (AU-6).
- 04Protect audit information and logging tools from unauthorized access, modification and deletion (AU-9).
03 / Records
Records to keep
- 01Audit and accountability policy and procedures (AU-1)
- 02Documented list of logged event types with rationale
- 03Log review reports and escalation records
- 04Log integrity protections and retention schedule configuration
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
NIST Computer Security Resource Center
NIST (usnistgov/oscal-content)
NIST Computer Security Resource Center
RELATED
Related: NIST 800-53 · AU: the full guide