The application server must compare internal application server clocks at least every 24 hours with an authoritative time source.

Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events.

Synchronization of system clocks is needed to correctly correlate the timing of events that occur across multiple systems. To meet this requirement, the organization will define an authoritative time source and have each system compare its internal clock at least every 24 hours.

Review application server documentation and confirm the application server compares internal application server clocks at least every 24 hours with an authoritative time source.

If the application server does not compare internal application server clocks to an authoritative source or if the frequency is greater than every 24 hours, this is a finding.

Configure the application server to compare internal application server clocks at least every 24 hours with an authoritative time source.