Auditors reviewing SOC 2 CC6.6 (Logical and Physical Access Controls) and CC7.2 (System Operations Monitoring) frequently ask for evidence that your systems have synchronized clocks. Accurate timestamps are critical for:
  • Audit trail integrity — correlating events across systems during incident investigation
  • Log accuracy — ensuring log entries carry correct timestamps for forensic analysis
  • Certificate validation — TLS/SSL certificates depend on accurate system time
  • Scheduled job reliability — cron jobs, backups, and compliance scans depend on clock accuracy

​
What Auditors Look For

NTP is enabled

Systems use Network Time Protocol (NTP) or a cloud-equivalent time sync service.

Clocks are synchronized

System time is within acceptable drift (typically under 1 second of an authoritative source).

Time source is authoritative

Systems sync to a trusted NTP pool or cloud provider time service (e.g., Amazon Time Sync, Google NTP).

Sync is automated

No manual clock setting — synchronization runs continuously via systemd-timesyncd, chrony, or equivalent.

​
Collecting Evidence

​
Linux Systems

Run the following command on each in-scope server:
Expected output (passing):
The key fields auditors care about:
If System clock synchronized shows no or NTP service shows inactive, the system is not synchronized and will fail this control.

​
Fixing a Non-Synchronized System

If NTP is not active, enable and start the time sync service:
For systems using chrony (common on RHEL/CentOS):

​
Cloud-Managed Systems

Most cloud providers handle time synchronization automatically:
EC2 instances use the Amazon Time Sync Service (169.254.169.123) by default. Verify with:
You should see 169.254.169.123 as a source with * (selected) status.

​
Containers and Kubernetes

Containers inherit the host’s clock. For Kubernetes:
Container timestamps are only as accurate as the host node’s clock. Ensure all Kubernetes nodes have NTP enabled.

​
Mapping to LowerPlane

In LowerPlane, clock synchronization is covered by:

​
How to Upload Evidence

  1. Navigate to Tests and find the “Clock synchronization” test
  2. Run timedatectl status on each in-scope system
  3. Save the output as a text file or screenshot
  4. Upload it as evidence on the test or link it to the LP-GO-054 control
Automate this. If you’ve connected your cloud infrastructure (AWS, GCP, Azure) as an integration, LowerPlane can automatically verify NTP status as part of the infrastructure sync. Check Integrations to see if your cloud provider is connected.

​
Common Audit Questions

That’s fine. Auditors care about the outcome (clocks are synced), not the specific tool. Collect evidence from both: timedatectl status for systemd-timesyncd, chronyc tracking for chrony.
For SOC 2, you need to demonstrate that clock sync is consistently applied across your environment. A sample of servers plus documentation of your configuration management (e.g., Ansible playbook, Terraform config) that enforces NTP is usually sufficient.
NTP typically keeps drift under 100 milliseconds. For compliance purposes, anything under 1 second is acceptable. The key is that NTP is active and continuously correcting drift.
No. Managed services handle time synchronization internally. A statement from the cloud provider’s shared responsibility documentation is sufficient evidence.