ASD ISM 0988 Ensure accurate time source for event logs
What it says
An accurate and consistent time source is used for event logging.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLogs must use a reliable time source for accuracy and consistency.
This control means that when your computer systems record events or actions, they must use a reliable clock to timestamp these logs. This is important because if your system logs the wrong time for these events, it could make finding out what happened during an incident nearly impossible and lead to major disruptions or data breaches being overlooked.
Free. Save your status, tasks and notes.
Why it matters
If systems do not use a consistent accurate time source, event logs cannot be reliably correlated, causing incorrect incident timelines and delaying investigations.
How to implement
The IT team should select a reliable time source: Choose a trustworthy and accurate clock, like the official time provided by a government body such as the National Measurement Institute (NMI), to set the system time for your computer networks.
System administrators should configure all devices: Ensure that all servers, desktops, and other devices on your network are set to the same reliable time source to maintain consistency across the organisation's systems.
Managers should regularly review time settings: Schedule routine checks to confirm that all devices are still set to the agreed-upon time source.
This can prevent drifts or changes that could occur over time.
The IT team should document time configurations: Keep a record of which time source is used and how each device or system is set to receive this time.
This helps in troubleshooting when issues arise.
System owners should include time source verification in audits: Make checking the time settings part of regular system audits to ensure ongoing compliance with this control.
Keep it running
Configure all hosts to synchronise with approved NTP sources and routinely confirm drift is within tolerance so event logs share a consistent, accurate timestamp.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of configured time sources: Request a document or report showing the time source settings of critical systems and devices within the organisation.
Look at
The uniformity and reliability of time sources: Verify that the same, reliable time source (e.g., NMI) is used consistently across all systems.
Good evidence
All critical systems are configured to the same accurate time source, with clear records of this configuration.
- Check 2 of 5What an auditor asks for
Ask for
Records of time accuracy checks: Request logs or records of regular time verification checks on the systems.
Look at
Consistency and corrective actions: Check if the checks are regularly performed and if any discrepancies were promptly addressed.
Good evidence
Regular, documented checks are in place, showing consistent time across systems, with actions taken if issues were found.
- Check 3 of 5What an auditor asks for
Ask for
The configuration management policy: Request the policy document that includes guidelines for setting and maintaining time sources on systems.
Look at
What the policy dictates: Ensure it specifies the use of a reliable time source and outlines procedures for maintaining accurate time settings.
Good evidence
A detailed policy that mandates using a reliable time source, with steps for regular verification.
- Check 4 of 5What an auditor asks for
Ask for
To demonstrate time-setting on a sample device: Request a live demonstration of how the time source is set and updated on a random device within the network.
Look at
The procedure and current settings: Observe the steps followed and compare the current settings to the documented standards.
Good evidence
The device shows the correct time source matching documented settings and procedures are followed correctly.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of staff training: Request records showing staff responsible for system configurations have been trained on time source management.
Look at
The training content and attendance: Check if the training covered the importance of accurate time sources and if all relevant staff attended.
Good evidence
Comprehensive training records showing that all relevant staff attended sessions and understood time source management.
Mappings
Closest match in ISO/IEC 27001: A.8.17, Clock synchronisation for information systems, which partially overlaps with this control.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.8.17.
Annex A 8.17 requires synchronisation of information system clocks to approved time sources. ISM-0988 demands a consistent time source for event logging which relates to synchronised system time for accuracy. Annex A 8.17 is the technical requirement applied across systems, while ISM-0988 frames this through logging outcomes. The relationship is partial overlap rather than equivalent.
This control supports A.8.15.
ISM-0988 requires an accurate and consistent time source to be used for event logging to ensure timestamps are trustworthy. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected and analysed, and accurate time is a quality prerequisite for correlating and analysing those logs. Annex A 8.15 is broader about logging controls overall, while ISM-0988 focuses specifically on timestamp correctness via time synchronisation.
This control depends on A.5.28.
ISM-0988 requires an accurate and consistent time source for event logging so timelines derived from logs are defensible. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identification, collection and preservation of evidence related to security events, which relies on accurate timestamps to establish sequence of events. Annex A 5.28 is about evidentiary handling and chain-of-custody, whereas ISM-0988 is about ensuring the underlying log time data is accurate.
ASD Essential Eight: 5 mappings
This control supports E8-AC-ML2.5.
E8-AC-ML2.5 requires central logging of allowed and blocked application control events to support monitoring and response. ISM-0988 requires an accurate and consistent time source for event logging, which is a prerequisite for making those centralised application control events trustworthy and correlatable during investigations. E8-AC-ML2.5 focuses on collecting specific application control events centrally, while ISM-0988 focuses on the integrity of timestamps across all logged events.
This control supports E8-AH-ML2.11.
E8-AH-ML2.11 requires central logging of detailed PowerShell execution artefacts so they can be monitored and investigated. ISM-0988 requires an accurate and consistent time source for event logging, which E8-AH-ML2.11 depends on to ensure PowerShell events can be correlated across endpoints and the central logging platform. ISM-0988 does not mandate any particular events be logged or centralised, but it underpins the forensic usefulness of the primary control.
This control supports E8-AH-ML3.4.
E8-AH-ML3.4 requires organisations to analyse event logs from non-internet-facing servers in a timely manner to detect cyber security events. ISM-0988 requires an accurate and consistent time source for event logging, which improves correlation, sequencing and incident reconstruction during log analysis. ISM-0988 does not require analysis itself, but it strengthens the reliability and usefulness of the analysis performed to satisfy E8-AH-ML3.4.
This control supports E8-MF-ML2.8.
E8-MF-ML2.8 requires organisations to analyse event logs from internet-facing servers in a timely manner to detect cyber security events. ISM-0988 requires an accurate and consistent time source for event logging, which is a prerequisite for reliable correlation, triage and sequence-of-events analysis when reviewing those logs. Without ISM-0988, E8-MF-ML2.8 analysis outcomes can be misleading due to timestamp drift and inconsistent timelines.
This control supports E8-RA-ML2.7.
E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISM-0988 requires an accurate and consistent time source for event logging, which strengthens the evidentiary value and correlation of central logs for privileged account and group changes. ISM-0988 does not itself require central logging, but it materially improves the usefulness of E8-RA-ML2.7 for detection and investigations.
ASD Essentials for enterprise IT: 1 mapping
- IT.DET-02.1Normalise, time-synchronise and enrich event logs for cross-system correlationPartially overlaps
This control partially overlaps IT.DET-02.1.
IT.DET-02.1 requires event logs to be normalised, time-synchronised and enriched to support correlation across systems and environments; ISM-0988 requires an accurate and consistent time source for event logging, which covers the time-synchronisation part.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.