Which statement about time synchronization across critical systems is true?

Which statement about time synchronization across critical systems is true?

• A. Only servers require time synchronization.
• B. Time synchronization is optional for PCI DSS scope.
• C. Clocks on client devices are enough for accuracy.
• D. Critical systems have the correct and consistent time.

Answer: (C)

Time synchronization is about making sure every device that handles or logs cardholder data shows the same time, so events can be lined up correctly across systems. In PCI DSS, all systems in scope should point to a trusted time source (usually UTC via NTP) and keep their clocks in sync. This consistency enables accurate logging, reliable incident response, and proper audit trails. The statement that is true reflects this idea: critical systems should have the correct and consistent time. If only some devices, like client desktops, are kept in sync while servers, network gear, and other components drift, logs will mismatch and it becomes very hard to reconstruct what happened or to verify security events. Time synchronization must be implemented across all relevant systems, not left to client devices alone and not treated as optional. A helpful practical note: configure a centralized, reliable time source, ensure all in-scope devices sync to it, monitor drift, and maintain a small time tolerance (commonly within about 5 minutes of UTC) to keep logs coherent.

Time synchronization is about making sure every device that handles or logs cardholder data shows the same time, so events can be lined up correctly across systems. In PCI DSS, all systems in scope should point to a trusted time source (usually UTC via NTP) and keep their clocks in sync. This consistency enables accurate logging, reliable incident response, and proper audit trails.

The statement that is true reflects this idea: critical systems should have the correct and consistent time. If only some devices, like client desktops, are kept in sync while servers, network gear, and other components drift, logs will mismatch and it becomes very hard to reconstruct what happened or to verify security events. Time synchronization must be implemented across all relevant systems, not left to client devices alone and not treated as optional.

A helpful practical note: configure a centralized, reliable time source, ensure all in-scope devices sync to it, monitor drift, and maintain a small time tolerance (commonly within about 5 minutes of UTC) to keep logs coherent.