Control A.8.17Clock synchronization
The clocks of information processing systems used by the organisation must be synchronised to approved time sources.
The quietest control in Annex A and the one that decides whether an investigation is possible. Correlating events across systems requires their timestamps to be comparable, and an estate whose clocks disagree by minutes produces a sequence of events that cannot be reconstructed.
The requirements are a defined authoritative source, synchronisation to it across the estate, a consistent reference — coordinated universal time, with local presentation if needed — and monitoring that drift is detected.
The two failures are drift on systems nobody monitors, and inconsistent time zones in log records that look correct individually and cannot be merged.
It also matters for evidence under A.5.28: a timestamp that cannot be shown to be accurate weakens everything built on it, and for records that may be relied on legally that is the difference between evidence and assertion.
How to put this in place
Logs from different systems can only be lined up if their clocks agree. Your ISMS needs a common time source so an investigation can rebuild events in the right order.
- Choose reliable time sources for the organisation.
- Point servers, workstations, network devices and cloud services at them.
- Record the time zone used in logs, preferably one for all.
- Check a sample of systems for drift.
- Fix devices that cannot keep time and note any exceptions.
Evidence an auditor usually looks for: time source settings on a sample of systems, and logs from different systems with matching timestamps.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.