PCI DSS v4.0/Requirement 10: Log and Monitor All Access to System Components and Cardholder Data/189 of 250
10.6.3Time-synchronization mechanisms support consistent time settings across all systems
Control family: Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
Control description
Defined Approach Requirements:
Time synchronization settings and data are protected as follows:
- Access to time data is restricted to only personnel with a business need.
- Any changes to time settings on critical systems are logged, monitored, and reviewed.
Defined Approach Testing Procedures:
10.6.3.a Examine system configurations and time-synchronization settings to verify that access to time data is restricted to only personnel with a business need.
10.6.3.b Examine system configurations and time synchronization settings and logs and observe processes to verify that any changes to time settings on critical systems are logged, monitored, and reviewed.