ASVS 5.0 V16.2.2 requires that all logging components use synchronized time sources, and that timestamps in security event metadata are in UTC or carry an explicit time zone offset. It is Level 2. Run time sync on every host and emit ISO 8601 timestamps in UTC.
Why it matters
If two servers disagree by two minutes, the order of events in an attack becomes unclear. Local time zones and daylight saving changes add confusion, including an hour that appears twice.
How to implement it
Enable time synchronization, for example with chrony:
# /etc/chrony/chrony.conf
pool time.example.com iburst
makestep 1.0 3
Check it with chronyc tracking. In cloud environments use the provider's time service. Configure loggers to write UTC:
const ts = new Date().toISOString(); // 2026-10-19T08:30:00.123Z
How to test it
Compare clock offset across hosts and containers. Generate one event on two services and confirm the timestamps agree within your tolerance. Scan logs for entries without a Z or offset.
Common mistakes
- Containers or appliances left out of time sync.
- Local time with no offset.
- Epoch values mixed with formatted strings.
Quick check
Is a local offset like +05:30 acceptable?
Yes, if it is explicit. UTC is simply easier to correlate.
