Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

au-8(1)

time stamps | synchronization with authoritative time source

assessment objective:

Determine if: 

au-8(1)(a)

au-8(1)(a)[1]

the organization defines the authoritative time source to which internal information system clocks are to be compared;

au-8(1)(a)[2]

the organization defines the frequency to compare the internal information system clocks with the organization-defined authoritative time source; and

au-8(1)(a)[3]

the information system compares the internal information system clocks with the organization-defined authoritative time source with organization-defined frequency; and

au-8(1)(b)

au-8(1)(b)[1]

the organization defines the time period that, if exceeded by the time difference between the internal system clocks and the authoritative time source, will result in the internal system clocks being synchronized to the authoritative time source; and

au-8(1)(b)[2]

the information system synchronizes the internal information system clocks to the authoritative time source when the time difference is greater than the organization-defined time period.

potential assessment methods and objects:

Examine: [select from: Audit and accountability policy; procedures addressing time stamp generation; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with information security responsibilities; system/network administrators; system developers].

Test: [select from: Automated mechanisms implementing internal information system clock synchronization].