PCI DSS 10.6.2: Systems are configured to the correct and consistent time
PCI DSS v4.0.1 control 10.6.2: the requirement in full, the 1 testing procedure an assessor uses to verify it, and the related controls in section 10.6.
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data › Section 10.6
Systems are configured to the correct and consistent time as follows:
- One or more designated time servers are in use.
- Only the designated central time server(s) receives time from external sources.
- Time received from external sources is based on International Atomic Time or Coordinated Universal Time (UTC).
- The designated time server(s) accept time updates only from specific industry-accepted external sources.
- Where there is more than one designated time server, the time servers peer with one another to keep accurate time.
- Internal systems receive time information only from designated central time server(s).
Summary
Time comes into the organisation through designated servers, and everything else takes time from them.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 10.6.2 | Examine system configuration settings for acquiring, distributing, and storing the correct time to verify the settings are configured in accordance with all elements specified in this requirement. |
Six elements describing one shape: a hierarchy. Designated central time servers are the only systems that take time from outside; internal systems take time only from those; where there is more than one central server they peer with each other. External sources must be industry-accepted and based on International Atomic Time or UTC. The single most common failure is the flattest possible architecture: every system pointed straight at a public NTP pool, which fails "internal systems receive time information only from designated central time server(s)" even though every clock is accurate. Accuracy is not what this control is about. It is about time entering through a controlled path, because a source you do not control is a way to move every clock at once, and 10.6.1 exists so events from different systems can be ordered.
What to prepare
- The designated time servers, named.
- Their external sources, and evidence those are industry-accepted and UTC-based.
- Configuration on a sample of internal systems showing they point at the designated servers.
- Peering configuration where there is more than one.
How to implement it
1. Draw the hierarchy explicitly. Two or three designated servers outward-facing, everything else inward, is the architecture the six elements describe.
2. Stop internal systems reaching external sources. Blocking outbound NTP except from the designated servers enforces the sixth element rather than relying on configuration everywhere.
3. Peer the central servers. It is a named element and it is the part most often skipped when there is more than one.
4. Check the cloud defaults. Cloud instances typically default to their provider's time service, which is accurate and is not your designated server.
Where this commonly fails
- Every system synchronising directly with a public pool, which is accurate and fails the requirement.
- Cloud instances left on the provider default while on-premises systems use the designated servers.
- Multiple central servers that never peer.
- External sources chosen ad hoc, with no statement of why they are industry-accepted.
Related controls
Others in section 10.6:
| Control | What it requires |
|---|---|
| 10.6.1 | System clocks and time are synchronized using time-synchronization technology |
| 10.6.3 | Time synchronization settings and data are protected… |
← 10.6.1 · All controls · 10.6.3 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.