BrowseToolsGuidesComparePricingStacksPlaybooksBlogSearch
ComplianceReadiness checkISO 27001ISO 42001SOC 2PCI DSSPolicy templatesControl mapCompliance softwareFramework compare
A.8.17A.8 Technological controls

Clock synchronization

A.5EVIDENCEA.6EVIDENCEA.7EVIDENCEA.8EVIDENCECONTROL MAPA.8.17 Evidence MapPOLICY / CONTROL / EVIDENCE / REVIEW

Purpose

Synchronise system clocks to approved time sources so security events can be correlated and investigations supported.

How to meet this control

In short: Synchronise clocks to an approved time source.

  1. Step 01Choose an authoritative reference time, such as a national time service or GPS-disciplined source, as the single standard
  2. Step 02Configure all servers, network devices and endpoints to synchronise via NTP or PTP against the agreed source
  3. Step 03Use redundant upstream time sources so a single failure does not let clocks drift
  4. Step 04In hybrid cloud and on-premises estates, monitor each platform clock and record any divergence
  5. Step 05Alert on clock drift beyond an acceptable tolerance so log correlation stays reliable
  6. Step 06Document the time architecture and the accuracy requirement in operating procedures

Tip: NTP everywhere so logs correlate across systems.

What ISO 27002 says to cover

Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.

  • ›Document and implement requirements for time representation, synchronisation and accuracy
  • ›Define a single standard reference time for use across all systems
  • ›Use a trusted reference clock linked to a national atomic clock or GPS time
  • ›Use protocols such as NTP or PTP to keep networked systems aligned
  • ›Consider using two external time sources at once to improve reliability
  • ›For mixed cloud and on-premises setups, monitor each service clock and record differences
  • ›Keep clocks accurate to preserve the evidential value of event logs

Audit evidence to keep

  • - Time synchronisation policy naming the reference source and tolerance
  • - NTP or PTP configuration on servers and network devices
  • - Monitoring or report showing clocks are within tolerance
  • - Evidence of redundant time sources configured
  • - Sample correlated logs demonstrating consistent timestamps

Common mistakes

  • - Writing a policy but not operating the process
  • - Keeping evidence in personal folders where auditors cannot trace it
  • - Letting exceptions stay open with no owner or expiry date

Owner, cadence, and proof

Assign one accountable owner for A.8.17. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.

Policy templates for this control

Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.

Acceptable use policyUse for ISO 27001 A.5.10, A.6.3, A.6.4, endpoint controls, remote work, and SOC 2 Security awareness.Incident response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident response, PCI DSS 12.10, and security event handling.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.
Open the control-to-policy map
← A.8.16 Monitoring activitiesA.8.18 Use of privileged utility programs →
Back to all technological controls or see the requirements (clauses 4 to 10). To run this control with automation, read how AI manages controls.