10.6 Time-synchronisation mechanisms are in place
How to meet it
Sync clocks to an authoritative source so logs correlate.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 10.6, in plain English.
10.6.1System clocks and time are synchronized using time-synchronization technology.
10.6.2Systems take time from designated servers sourced from accepted external time (atomic time or UTC).
10.6.3Time-synchronization settings are protected, with access restricted and changes logged and reviewed.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.Human resources security policyUse for ISO 27001 A.6.1 to A.6.6, A.6.8, SOC 2 Security, and personnel security controls.
Open the control-to-policy map← 10.5 Audit log history is retained10.7 Failures of critical security controls are detected and responded to →
Back to Requirement 10, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.