NIST SP 800-171 & CMMC 2.0 Control 3.3.7 Requirement:

Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

NIST SP 800-171 & CMMC 2.0 3.3.7 Requirement Explanation:

Each of your systems must synchronize its time with a central time server. This ensures that all systems are recording audit logs using the same time. If different systems have different times, it makes reviewing audit logs difficult.

Example NIST SP 800-171 & CMMC 2.0 3.3.7 Implementation:

Configure the time settings on your computers, servers, and network devices to sync with the NIST time server ( If you have a local time server on your network you can sync it with the NIST time server and sync your other systems with your local time server. You can deploy the time server settings to your Windows computers using group policy or Microsoft EndPoint Manager.

NIST SP 800-171 & CMMC 2.0 3.3.7 Scenario(s):

- Scenario 1:

Alice is a system administrator who maintains her small company's computers. She wants to ensure that her Windows 10 workstations keep accurate time. To do this she configures them to sync with NIST's Time Server. She located the IP address for the time server on the NIST Internet Time Server website.

- Scenario 2:

Bill is a system administrator who maintains his company's IT infrastructure. His network has several servers including a time server, network devices, and dozens of workstations. The systems on his network are already synced to his time server however the time given by the time server is about 15 seconds behind. To resolve this, Bill syncs his time server with server.

Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:


Compliance Accelerator

Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.

Quantum Assessor

Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.

Supply Chain Verifier

Trust is everything. Verify, monitor, and support subcontactor compliance.