SC-45(2)

Requirement
1. Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source; and
2. Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable.

Discussion

It may be necessary to employ geolocation information to determine that the secondary authoritative time source is in a different geographic region.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing time synchronization; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system].

Test

[SELECT FROM: Mechanisms supporting and/or implementing system time synchronization with secondary authoritative time sources].

ID	Assessment Objectives
SC-45(02)(b)	the internal system clocks are synchronized to the secondary authoritative time source if the primary authoritative time source is unavailable.
SC-45(02)(a)	a secondary authoritative time source is identified that is in a different geographic region than the primary authoritative time source;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!