A.8.17 Clock synchronization
Synchronize system clocks to approved time sources.
12
artefacts
4
held by a system
2
at each review
moderate
to go live
Ticketing / ITSM
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Change management records for NTP configuration changes · Ticketing / ITSM
- Automated synchronization logs · SIEM / log platform
- Alert records for time drift events · SIEM / log platform
- Incident tickets for time drift incidents · Ticketing / ITSM
periodic reviewEvidence produced at each review
- System configuration screenshots showing NTP settings · Cloud console / configuration management
- Monthly synchronization compliance report · SIEM / log platform
governing documentDocuments that govern the control
- Approved time source list · Policy repository / GRC workspace
- Vendor certificates for NTP servers · Vendor register / contract repository
- Network diagram showing time source connections · Policy repository / GRC workspace
- Policy document for time synchronization settings · Policy repository / GRC workspace
- Root cause analysis reports for synchronization failures · Document repository
- Corrective action plan for time synchronization issues · Policy repository / GRC workspace
First move
Start with the 4 of 12 artefacts that already live in a system (Ticketing / ITSM); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Using unsanctioned public NTP servers
- No regular verification of time drift
- Missing documentation of configuration changes
- Inadequate handling of synchronization failures
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.8.16 Monitoring activities · A.8.18 Use of privileged utility programs