Where there is more than one designated time Review time configuration server, do the time servers peer with each other to standards and processes keep accurate time? Examine time-related system parameters Do systems receive time only from designated Review time configuration central time server(s)? standards and processes Examine time-related system parameters 10.4.2 Is time data is protected as follows: Examine system configurations and Is access to time data restricted to only personnel settings with a business need to access time data? Are changes to time settings on critical systems Examine system logged, monitored, and reviewed? configurations and settings and logs 10.4.3 Are time settings received from specific, Examine system time sources? (This is to prevent a malicious configurations individual from changing the clock). Optionally, those updates can be encrypted with a symmetric key, and access control lists can be created that specify the IP addresses of client machines that will be provided with the time updates (to prevent unauthorized use of internal time servers). 10.5 Are audit trails secured so they cannot be altered, as follows: 10.5.1 Is viewing of audit trails limited to those with a Interview system need? administrators Examine system configurations and permissions
Where there is more than one designated time server, do the time servers peer with each other to keep accurate time? Review time configuration standards and processes Examine time-related system parameters Do systems receive time only from designated central time server(s)? Review time configuration standards and processes Examine time-related system parameters 10.4.2 Is time data is protected as follows: Is access to time data restricted to only personnel with a business need to access time data? Examine system configurations and settings Are changes to time settings on critical systems logged, monitored, and reviewed? Examine system configurations and settings and logs 10.4.3 Are time settings received from specific, time sources? (This is to prevent a malicious individual from changing the clock). Optionally, those updates can be encrypted with a symmetric key, and access control lists can be created that specify the IP addresses of client machines that will be provided with the time updates (to prevent unauthorized use of internal time servers). Examine system configurations 10.5 Are audit trails secured so they cannot be altered, as follows: 10.5.1 Is viewing of audit trails limited to those with a need? Interview system administrators Examine system configurations and permissions