ISO 27001 Annex A 8.17 Clock synchronisation for information systems
What it says
The clocks of information processing systems used by the organization shall be synchronized to approved time sources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all system clocks are set to the same time source to aid in event tracking and investigations.
This control is about making sure all the clocks on your organisation's computers and systems are set to the exact same time. This consistency helps when you need to track what happened and when, especially if you're investigating an incident or resolving a dispute. If the clocks are off, it can be hard to prove the sequence of events, which can cause issues with accountability or legal matters.
Free. Save your status, tasks and notes.
Why it matters
Unsynchronised system clocks hinder accurate log/event correlation, weakening investigations, audit trails and incident response timing.
How to implement
The IT Manager should ensure there is a standard reference time source for the organisation.
To do this, set up a clock that is linked to a reliable time source, like a national atomic clock or GPS system. Use network protocols, like NTP (Network Time Protocol), to keep all computers and devices synced to this time.
The IT Department should develop and document a policy for clock synchronisation.
This policy should explain why accurate timekeeping is critical and provide steps for maintaining it, including setting up and monitoring time sources according to ISO 27002:2022 guidance.
Procurement should ensure that all new systems and software purchased support time synchronisation mechanisms.
When evaluating suppliers, ask about their products' compatibility with common time-synchronisation protocols like NTP and their ability to work with external reliable time sources.
System Administrators should regularly check and maintain the synchronisation configuration on networks and individual devices.
This includes periodically verifying that all clocks on the systems are correctly aligned with the chosen reference time source.
Security Officers should monitor the synchronisation process and document any discrepancies.
They should implement alerts to detect when a system falls out of sync, ensuring any such issues are investigated promptly to mitigate security risks.
Keep it running
Configure NTP on all hosts to approved time sources; monitor drift (eg <100 ms) and alert on offsets or NTP failures.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's clock synchronisation policy and procedures.
Look at
The level of detail and alignment with ISO 27002:2022 guidance.
Good evidence
A clear, well-documented policy that specifies time sources and protocols used.
- Check 2 of 5What an auditor asks for
Ask for
Logs or reports from the time synchronisation service.
Look at
The consistency of time settings across different systems.
Good evidence
Uniform time with minimal discrepancies between systems, indicating successful synchronisation.
- Check 3 of 5What an auditor asks for
Ask for
Documentation of the external time sources used.
Look at
Names of time sources and evidence of their reliability.
Good evidence
The use of recognised, accurate time sources such as national atomic clocks or GPS systems.
- Check 4 of 5What an auditor asks for
Ask for
To see records of system checks related to clock synchronisation.
Look at
How often checks are done and what issues are recorded.
Good evidence
Regular checks with detailed records and quick resolutions of any noted discrepancies.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of routine training or communication to IT staff about clock synchronisation importance.
Look at
Training materials or meeting notes.
Good evidence
Regular updates or sessions that reinforce the importance and practices of maintaining synchronised clocks.
Mappings
Closest match in ASD Information Security Manual: ISM-0988, Ensure accurate time source for event logs, which partially overlaps with this control.
ASD Essential Eight: 2 mappings
This control supports E8-AH-ML2.15.
E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISO/IEC 27001:2022 Annex A 8.17 supports this by ensuring clock synchronisation so event timestamps across systems are comparable, enabling accurate correlation and rapid triage during incident identification. Annex A 8.17 is a time integrity/consistency control and does not itself require event analysis or incident determination.
This control supports E8-RA-ML2.10.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 8.17 requires clock synchronisation so event timestamps are consistent across systems, which improves the quality and speed of analysis performed under E8-RA-ML2.10. Annex A 8.17 does not require any analysis activity itself; it strengthens investigative accuracy and correlation during incident identification.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-0988.
Annex A 8.17 requires synchronisation of information system clocks to approved time sources. ISM-0988 demands a consistent time source for event logging which relates to synchronised system time for accuracy. Annex A 8.17 is the technical requirement applied across systems, while ISM-0988 frames this through logging outcomes. The relationship is partial overlap rather than equivalent.
This control supports ISM-0585.
Annex A 8.17 addresses synchronising information system clocks to approved time sources. ISM-0585 focuses on logging event timestamps which require accurate and synchronised clocks. This relationship supports reliable timestamping necessary for effective log management.
ASD Essentials for enterprise IT: 1 mapping
- IT.DET-02.1Normalise, time-synchronise and enrich event logs for cross-system correlationPartially overlaps
This control partially overlaps IT.DET-02.1.
IT.DET-02.1 requires event logs to be normalised, time-synchronised and enriched to support correlation across systems and environments. Its time-synchronisation element overlaps with Annex A 8.17, which requires the clocks of information processing systems to be synchronised to approved time sources, and in practice relies on it. IT.DET-02.1 also requires normalisation and enrichment, while Annex A 8.17 applies to all system clocks and requires approved time sources.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.