How do you implement A.8.17 in Microsoft 365?

A.8.17 Clock Synchronisation can be implemented in Microsoft 365 using Azure Portal > Virtual machines > [VM] > Extensions + applications; Windows Admin Center > Server Manager > Services. Contact Global Micro Solutions for a detailed implementation guide.

What does an auditor check for A.8.17?

Auditors verify that A.8.17 Clock Synchronisation is properly implemented by reviewing evidence from your M365 tenant, checking configuration against ISO 27001 requirements, and validating compliance documentation.

ISO 27001 A.8.17: Clock Synchronisation — M365 Implementation Guide | Global Micro Solutions

What is this control?

ISO 27001 control A.8.17 Clock Synchronisation ensures that the clocks of all information processing systems within the organisation are synchronised to approved time sources. The control maintains accurate and consistent timekeeping across all systems, mitigating risks of inaccurate audit trails, failed event correlation, and time-based authentication vulnerabilities. Systems are synchronised to Microsoft Azure time services, Apple time services, and Google time services.

How to implement in Microsoft 365

Implement A.8.17 by deploying Intune configuration profiles for time synchronisation across all platforms including Windows 10 and 11 Settings Catalog, macOS Settings Catalog, and Android Device Restrictions. Configure all systems to synchronise to approved time sources including time.windows.com, time.apple.com, and time.google.com. Set organisation default time zone to South Africa Standard Time which is UTC plus 2.

Enforce UTC timestamps in all audit logs via cloud platform inherent controls. Deploy browser time services via Microsoft Edge and Google Chrome. Restrict system time modification permissions to Administrators and LOCAL SERVICE only.

What an auditor looks for

Auditors will verify Intune configuration profiles for time synchronisation are deployed across Windows, macOS, and Android platforms. They will check audit logs contain consistent UTC timestamps demonstrating synchronisation integrity. Auditors will verify configuration showing system time modification restrictions are enforced on endpoints.

They will check cloud platform time synchronisation verification through supplier governance via Microsoft SOC 2 Type II reports. Auditors will verify compliance policy deployment across all managed endpoints with 95% or higher adoption rate.