SFS 6 / SF 3

Back to SFS 6

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are security event timestamps synchronized across all critical systems to ensure accurate incident correlation during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Verified time synchronization using approved protocol (e.g., NTP) with evidence of consistent timestamps

Assessment criterion and evidence

Actor: Organization. Scope: All systems generating security-relevant logs. Evidence period: Review period. Required evidence: Documented time synchronization configuration; Log samples showing consistent timestamps across systems. Negative criterion: Evidence of unsynchronized timestamps across systems affecting incident analysis. Missing evidence: Pending validation when no evidence of time synchronization mechanism is provided

View the JSON record (opens in a new tab).

Assessment result: unset.