3.2.6 To the extent feasible, the relevant entities shall ensure that all systems have synchronised time …

Requirement

To the extent feasible, the relevant entities shall ensure that all systems have synchronised time sources to be able to correlate logs between systems for event assessment. The relevant entities shall establish and keep a list of all assets that are being logged and ensure that monitoring and logging systems are redundant. The availability of the monitoring and logging systems shall be monitored independent of the systems they are monitoring.

Guidance

• Consider the following for time synchronisation:
  • Utilize Network Time Protocol (NTP) servers or Precision Time Protocol (PTP) for accurate and reliable time synchronization (24).
  • Use authenticated NTP to prevent malicious entities from tampering with your time synchronization.
  • Configure a central time server within the entity (25). This server should synchronize with a reliable external time source and then distribute the time to all other systems within the network.
  • Use multiple time sources to avoid a single point of failure.
  • Plan how time synchronization is handled across on-premises systems (for example servers in a company's own data centre), cloud services, and software-as-a-service (SaaS) platforms - especially if the organization uses a hybrid environment (a mix of on-premises and cloud-based systems).
• Assets being logged should be marked as such in the asset inventory, in line with what is referred to in point 12.4 of the Annex to the regulation.
• Implement measures to protect log data against loss, including but not limited to redundant storage across multiple locations (e.g. cloud, secondary servers), retention of processed log events in structured systems and preservation of derived security insights (e.g. alerts, metrics) in line with what is referred to in point 4.2 of the Annex to the regulation. These complementary approaches ensure both data integrity and operational continuity in security monitoring and incident response.
• Deploy separate tools to monitor the capacity and availability of the entity’s primary monitoring and logging systems.

Examples of evidence

• Mechanisms for logs’ time synchronisation.
• Mechanisms for logs’ redundant storage.
• Logs from the activity of the tools that monitor the capacity and availability of the entity’s primary monitoring and logging systems.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

3. Povezani predpisi

Povezane zadeve

• ENISA -