ISO 27001:2022 Annex A 8.17 – Clock Synchronisation

• See ISO 27002:2022 Control 8.17 for more information.
• See ISO 27001:2013 Annex A 12.4.4 for more information.

ISO 27001:2022 Annex A 8.17 – Best Practices for Clock Synchronization

It is critical to have precise, synchronised time across all an organisation’s information systems.

Not only is this necessary to maintain business operations, but it is also invaluable when dealing with ICT-related incidents.

Accurate time representation provides an organisation with the capacity to give a reliable record of how data has been managed and the activities of its staff and vendors to itself and any law enforcement or regulatory agencies.

Purpose of ISO 27001:2022 Annex A 8.17

ISO 27001:2022 Annex A 8.17 serves a dual purpose by maintaining risk through the implementation of controls to maintain accurate and reliable synchronisation of information system clocks. This helps in both internal and external investigations, as well as incident monitoring.

Ownership of Annex A 8.17

ISO 27001:2022 Annex A 8.17 is focused on technical issues, such as external data sources (e.g. atomic clocks) connected to an organisation’s ICT infrastructure.

The Head of IT should own the responsibility for maintaining the integrity and effectiveness of an organisation’s ICT infrastructure on a daily basis.

Guidance on ISO 27001:2022 Annex A 8.17

Annex A Control 8.17 refrains from proposing a step-by-step approach to managing system clocks, instead providing broad direction on how to utilise reliable reference points.

Organisations should establish a standard reference time that can be relied on for all their commercial, logistical, and maintenance-oriented systems. This is in accordance with Annex A 8.17.

Organisations should:

1. Draft internal and external requirements for three aspects of clock synchronisation:
• Reliable synchronisation
• Time representation
• Accuracy
2. Organisations should address said requirements from six different angles:
• Contractual
• Standards
• Internal monitoring
• Legal
• Statutory
• Regulatory
3. Utilise a radio time broadcast linked to an atomic clock as the single reference point, whilst implementing key protocols (NTP, PTP) to guarantee uniformity throughout the network.
4. It is worth considering the benefits of having two distinct time sources to improve redundancy.

Guidance on Hybrid Setups

Organisations often employ both on-site and cloud-based systems side-by-side.

Cloud-hosted software and infrastructure platforms are typically managed by the vendor themselves, utilising an independent time source from the organisation’s own infrastructure.

Regularly check for any discrepancies between managed and unmanaged hardware and systems, and document any variations to avoid confusion in future enquiries.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 8.17 supersedes ISO 27001:2013 Annex A 12.4.4 (Clock Synchronisation).

ISO 27001:2022 Annex A 8.17 echoes much of the same data found in its 2013 predecessor, except for one salient point – it gives guidance on managing time sources from public and private clouds, as well as the implications of using systems on-site that may be synced to a different time source.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Helps

At ISMS.online, our cloud-based platform allows you to generate, upkeep, and evaluate your ISO 27001 standards-based information security management system (ISMS).

Our platform enables you to set up an ISMS according to the international standard and use the checklists to ensure your information security processes are in good shape. Moreover, ISMS.online provides risk and vulnerability assessment to detect weak points in the current infrastructure needing immediate attention.

ISMS.online equips you with the necessary tools and resources to prove you are compliant with ISO 27001.

Contact us today to arrange a demonstration.