Rule ID
SV-207464r984238_rule
Version
V2R3
CCIs
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Synchronizing internal VMM clocks provides uniformity of time stamps for VMMs with multiple system clocks and systems connected over a network.
Verify the VMM synchronizes internal information system clocks to the authoritative time source when the time difference is greater than one second. If it does not, this is a finding.
Configure the VMM to synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.