PCI DSS v4.0/Requirement 10: Log and Monitor All Access to System Components and Cardholder Data/188 of 250
10.6.2Time-synchronization mechanisms support consistent time settings across all systems
Control family: Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
Control description
Defined Approach Requirements:
Systems are configured to the correct and consistent time as follows:
- One or more designated time servers are in use.
- Only the designated central time server(s) receives time from external sources.
- Time received from external sources is based on International Atomic Time or Coordinated Universal Time (UTC).
- The designated time server(s) accept time updates only from specific industry-accepted external sources.
- Where there is more than one designated time server, the time servers peer with one another to keep accurate time.
- Internal systems receive time information only from designated central time server(s).
Defined Approach Testing Procedures:
10.6.2 Examine system configuration settings for acquiring, distributing, and storing the correct time to verify the settings are configured in accordance with all elements specified in this requirement.