RHEL 9 must have the chrony package installed.

Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.

Verify that RHEL 9 has the chrony package installed with the following command:

$ dnf list --installed chrony

Example output:

chrony.x86_64 4.1-3.el9

If the "chrony" package is not installed, this is a finding.

The chrony package can be installed with the following command:

$ sudo dnf install chrony