3.3.7 — Synchronize clocks for time stamps | NIST 800-171 & CMMC Level 2

System clocks sync to an authoritative time source.

What it actually means

If two systems' clocks disagree, correlating their logs during an investigation becomes guesswork. Systems must sync to an authoritative time source (NTP) so audit time stamps line up.

Pass or fail — an assessor needs a "yes" to each

Systems sync to an authoritative time source (NTP).
Audit time stamps are consistent across systems.

What to have ready

NTP/time-sync configuration
Confirmation of a consistent authoritative source

Where teams trip up

Drifting clocks across servers/endpoints
Different time zones not normalized in logs

See where this control puts your score

Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.

Calculate your SPRS score →Draft your SSP language →

Connected requirements

3.3.1 — Time stamps on the records 3.3.5 — Correlation needs aligned time

More in Audit & Accountability (3.3)

3.3.1 — Create and retain audit logs 3.3.2 — Trace actions to individual users 3.3.3 — Review and update what you log 3.3.4 — Alert when logging breaks 3.3.5 — Correlate and review your logs 3.3.6 — Reduce logs and generate reports 3.3.8 — Protect your logs from tampering 3.3.9 — Limit who manages logging

← Back to the Control Library