Auditors reviewing SOC 2 CC6.6 (Logical and Physical Access Controls) and CC7.2 (System Operations Monitoring) frequently ask for evidence that your systems have synchronized clocks. Accurate timestamps are critical for:
  • Audit trail integrity — correlating events across systems during incident investigation
  • Log accuracy — ensuring log entries carry correct timestamps for forensic analysis
  • Certificate validation — TLS/SSL certificates depend on accurate system time
  • Scheduled job reliability — cron jobs, backups, and compliance scans depend on clock accuracy

​
What Auditors Look For

NTP is enabled

Systems use Network Time Protocol (NTP) or a cloud-equivalent time sync service.

Clocks are synchronized

System time is within acceptable drift (typically under 1 second of an authoritative source).

Time source is authoritative

Systems sync to a trusted NTP pool or cloud provider time service (e.g., Amazon Time Sync, Google NTP).

Sync is automated

No manual clock setting — synchronization runs continuously via systemd-timesyncd, chrony, or equivalent.

​
Collecting Evidence

​
Linux Systems

Run the following command on each in-scope server: 
timedatectl status
Expected output (passing): 
               Local time: Mon 2026-06-23 10:15:32 UTC
           Universal time: Mon 2026-06-23 10:15:32 UTC
                 RTC time: Mon 2026-06-23 10:15:32
                Time zone: UTC (UTC, +0000)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no
The key fields auditors care about:
FieldExpected ValueWhy It Matters
System clock synchronizedyesConfirms the clock is actively synced to an NTP source
NTP serviceactiveConfirms the NTP daemon is running
Time zoneUTC (recommended)UTC avoids daylight saving ambiguity in logs
If System clock synchronized shows no or NTP service shows inactive, the system is not synchronized and will fail this control.

​
Fixing a Non-Synchronized System

If NTP is not active, enable and start the time sync service: 
# Enable and start systemd-timesyncd
sudo timedatectl set-ntp true

# Verify it's now active
timedatectl status
For systems using chrony (common on RHEL/CentOS): 
# Check chrony sync status
chronyc tracking

# Verify sources
chronyc sources -v

​
Cloud-Managed Systems

Most cloud providers handle time synchronization automatically:
EC2 instances use the Amazon Time Sync Service (169.254.169.123) by default. Verify with:
chronyc sources -v
You should see 169.254.169.123 as a source with * (selected) status.

​
Containers and Kubernetes

Containers inherit the host’s clock. For Kubernetes: 
# Check node time sync (run on each node)
kubectl get nodes -o wide
ssh <node> timedatectl status
Container timestamps are only as accurate as the host node’s clock. Ensure all Kubernetes nodes have NTP enabled.

​
Mapping to LowerPlane

In LowerPlane, clock synchronization is covered by:
ControlFrameworkCriteria
LP-GO-054 — Clock SynchronizationSOC 2 CC6.6, CC7.2Systems use NTP with authoritative time sources
LP-AU-001 — Audit Logging PolicyISO 27001 A.8.17Log timestamps must be accurate and synchronized

​
How to Upload Evidence

  1. Navigate to Tests and find the “Clock synchronization” test
  2. Run timedatectl status on each in-scope system
  3. Save the output as a text file or screenshot
  4. Upload it as evidence on the test or link it to the LP-GO-054 control
Automate this. If you’ve connected your cloud infrastructure (AWS, GCP, Azure) as an integration, LowerPlane can automatically verify NTP status as part of the infrastructure sync. Check Integrations to see if your cloud provider is connected.

​
Common Audit Questions

That’s fine. Auditors care about the outcome (clocks are synced), not the specific tool. Collect evidence from both: timedatectl status for systemd-timesyncd, chronyc tracking for chrony.
For SOC 2, you need to demonstrate that clock sync is consistently applied across your environment. A sample of servers plus documentation of your configuration management (e.g., Ansible playbook, Terraform config) that enforces NTP is usually sufficient.
NTP typically keeps drift under 100 milliseconds. For compliance purposes, anything under 1 second is acceptable. The key is that NTP is active and continuously correcting drift.
No. Managed services handle time synchronization internally. A statement from the cloud provider’s shared responsibility documentation is sufficient evidence.