PCI DSS 4.0 10.6.3: 10.6.3 Time sync configuration and time data protected
Time synchronization settings and data must be protected as follows: only personnel with a business need may access time data; and any change to time settings on critical systems must be logged, monitored and reviewed. Applies to all entities. The guidance explains that attackers alter time settings to cover their tracks, so limiting who can change time configuration or system time reduces that risk. Customized approach objective: unauthorized personnel cannot change system time settings.
This control maps to 41 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring
You are reading one control. How much of PCI DSS 4.0 have you already done?
PCI DSS 4.0 10.6.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.