Key takeaways
- Synchronise system clocks to a trusted time source.
- Accurate, consistent time is essential to correlate logs and investigate incidents.
- Start here: synchronise systems to trusted time sources.
Purpose
Synchronise system clocks to a trusted time source.
Requirement
Requirement summaryThe clocks of information processing systems used by the organization shall be synchronized to approved time sources.
Why it matters
Accurate, consistent time is essential to correlate logs and investigate incidents.
How to implement
- Synchronise systems to trusted time sources.
- Use a consistent time zone or UTC in logs.
- Monitor for time drift.
- Document the time sources used.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.17. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rule that all systems use the same trusted time source.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.17 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Settings from key systems showing they sync to the approved time source.
- A sample of logs from different systems showing matching timestamps.
- Records of any time sync problems and how they were fixed.
- Your list of key systems covered by the rule.
Things you should be able to show or explain
- Be able to show timestamps lining up across two systems.
How much to show: Three to five systems.
Common mistakes
- Clocks out of step, making incidents hard to investigate.
- No approved time source.
- Systems with different clocks making timelines impossible.
- Undocumented time sources.
- Tip: Use NTP; it makes incident timelines possible.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.17 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.17?
Be ready to explain how the control works in your organisation and to provide things like: Your rule that all systems use the same trusted time source…