Clock synchronization

Plain-language summary

Synchronising the clocks of servers, network devices, endpoints and applications to an approved, reliable time source, so that logs from different systems can be lined up and trusted when you need to reconstruct an incident.

What the clause is really asking

This control looks minor until an investigation needs to line up events from the firewall, the identity provider, the endpoint protection console and the ERP, and they are minutes or hours apart. Without consistent time, the sequence of an attack cannot be established, and evidence may be challenged in disciplinary or legal proceedings. The control asks you to document your requirements for time — which reference source, how systems synchronise, the accuracy needed, and how time is represented — and to synchronise all relevant systems to it, typically using Network Time Protocol from domain controllers or the firewall to a reliable external source. In South Africa the National Metrology Institute (NMISA) maintains the national time standard, and reputable public NTP pools are also widely used. Two practical traps: cloud services usually log in UTC while on-premises systems log in South African Standard Time, two hours ahead; and devices on isolated production networks drift because they cannot reach a time source. ISO 9001 practitioners will recognise the idea from measurement traceability: every clock traces back to one trusted reference.

What auditors look for

Auditors ask what your approved time source is and where that decision is written down. They then check a sample: the domain controller's time configuration, the firewall's settings, a network switch, a server, and the timestamp on a log entry in your cloud tenant. They compare the time recorded for the same event in two systems. They ask how investigators handle UTC versus local time and whether isolated networks have their own synchronised source. The hard question: if a sign-in appears at 02:14 in one log and 04:14 in another, which is right, and how would an investigator know?

Typical evidence

Time synchronisation standard naming approved sources, required accuracy and time zone conventions; NTP configuration on domain controllers, firewalls, switches and servers; synchronisation status reports or monitoring alerts; endpoint time settings; documented handling of UTC and local time in log analysis; records of drift detected and corrected; arrangements for isolated or production networks.

How to comply — recommendations

Write a half-page time standard: one or two approved external sources, an internal hierarchy (typically the domain controllers or core firewall synchronise externally and everything else synchronises to them), the accuracy you need, and whether logs are kept in UTC or local time. Configure NTP on every server, network device and endpoint accordingly, and alert on synchronisation failure. Give isolated production or building-management networks a local time source that is itself synchronised. Record the time zone convention in your incident procedure so investigators convert consistently. Check a sample of devices quarterly and after major changes. It takes a morning to fix and can save days in an investigation.

Common nonconformities

No defined time source; servers, network devices and endpoints with different or unsynchronised clocks; NTP configured but failing unnoticed; inconsistent time zones across logs with no documented convention; isolated networks with drifting clocks; cloud and on-premises timestamps never reconciled; time synchronisation not addressed in the logging standard.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.