The clocks of the organization's information processing systems are to be kept in step with approved time sources. Purpose: allow security events and other recorded data to be correlated and analysed, and support incident investigations. Guidance: document and implement external and internal requirements for how time is represented, how reliably it is synchronized and how accurate it must be, which may come from law, regulation, contracts, standards or internal monitoring. Define one standard reference time for the organization and apply it to all systems, including building management, entry and exit and other systems that may help investigations. Use a reference clock for logging systems tied to a national atomic clock radio broadcast or GPS, giving a consistent, trusted source for accurate timestamps, and keep networked systems aligned with it through protocols such as NTP or PTP. Two external time sources can be used together to improve reliability, with any difference between them managed. Where several cloud services, or cloud and on-premises services, are combined, synchronization is harder, so monitor each service's clock and record the difference to limit the risk of discrepancies. Other information: correct clocks keep event logs accurate, which matters for investigations and for evidence in legal or disciplinary cases; wrong timestamps hamper investigations and weaken evidence.
This control maps to 25 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 8.17 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 25 it maps to, and the evidence behind each claim, over MCP and REST.