PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 10 / c10.3
Quick Wins Infrastructure ProtectionSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c10.3 Reliable time synchronization (10.6)

Ensure that system clocks are synchronized with a reliable time source so that log timestamps are consistent and trustworthy.

Quick Wins
Foundational
Efficient
Optimized
Effort: Low Impact: Medium Applies to CDE: Yes

Requirement 10

Log and Monitor All Access to System Components and Cardholder Data

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

10.6 Time-synchronization mechanisms support consistent time settings
  • 10.6.1 System clocks and time synchronized using time-sync technology Covered
  • 10.6.2 Systems configured to correct and consistent time Covered
  • 10.6.3 Time synchronization settings and data protected Covered

How to implement on AWS

Use the Amazon Time Sync Service (NTP at 169.254.169.123) on all EC2 instances. Restrict who can modify the time configuration. Verify synchronization centrally. AWS managed services already use synchronized time.

Practical implementation

How this control is implemented in each reference architecture:

Synchronize all clocks to a reliable source so log timestamps are consistent and trustworthy.

  1. Configure the Amazon Time Sync Service (169.254.169.123) on all EC2 instances via the baseline image or SSM.
    App tier (CDE) / Data tier (CDE) Amazon EC2 Systems Manager
  2. Restrict who can change time settings and log changes to the time configuration on critical systems.
    App tier (CDE) / Data tier (CDE) IAM CloudTrail

How to validate: Instances sync to the Amazon Time Sync Service, time-setting changes are restricted and logged, and clocks agree across components.

Avoid: Letting each instance use arbitrary public NTP. Standardize on the Amazon Time Sync Service for a consistent, reliable source.

Single-account, 3-tier →

Standardize the time source across every account baseline so all CDE accounts agree on time.

  1. Bake the Amazon Time Sync Service into the golden AMI and account baselines (Control Tower / IaC) so every account uses it by default.
    Account baseline (all accounts) Control Tower EC2 Image Builder
  2. Restrict and log time-config changes consistently across accounts.
    Each CDE workload account IAM CloudTrail

How to validate: Every account baseline enforces the Amazon Time Sync Service and time-change logging is consistent org-wide.

Avoid: Configuring time per account by hand. Bake it into the baseline so no account drifts to an unreliable source.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine configuration settings to verify time-synchronization technology is implemented and kept current (10.6.1).
  • Examine configurations for acquiring, distributing, and storing correct time (10.6.2), and verify access to time data is restricted and changes to time settings on critical systems are logged, monitored, and reviewed (10.6.3.a, 10.6.3.b).

Evidence in AWS

  • Amazon Time Sync Service configuration on in-scope instances.
  • Permission restrictions for changing the time configuration.
  • Evidence of clock synchronization across system components.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 10.6 — Common time is established across all systems.

AWS services

Amazon Time Sync Service Amazon EC2

Learning resources

References

  • PCI DSS v4.0.1 Requirement 10.6