GPS gives more than location. It is often the source of accurate time for networks, power systems and communications towers. CISA says GPS is in many cases the sole source of positioning, navigation and timing data, which leaves those sectors open to disruption or fake signals. Find your dependency before an outage does.
What CISA states
CISA says infrastructure sectors rely on accurate positioning, navigation and timing, called PNT. It identifies GPS as the main source and in many cases the sole source, so intentional or unintentional disruption of the signal is a risk. It also notes that broadcasting fake GPS signals has become simpler with newer technology.
CISA also lists resources: a conformance framework for GPS receivers, guidance for assessing PNT dependencies, a basic spoofing detection algorithm suite, an integrity library, and time guidance for network operators, CIOs and CISOs.
Why time matters
Distributed systems need agreed time. Wrong or jumping clocks can break log correlation, certificate validation, authentication tokens, database replication and scheduled jobs. Some systems fail loudly. Others corrupt data quietly.
How to find the dependency
- List every time source: network time servers, appliances with GPS antennas, cloud time services.
- Trace each source back. Does it end at a GPS receiver?
- Ask which systems stop or misbehave if time jumps or drifts.
- Check whether any receiver can detect bad signals or fall back to a local oscillator.
How to reduce the risk
- Use more than one independent time source where practical.
- Choose receivers evaluated against a security conformance framework where available.
- Monitor time offset and alert on sudden jumps, not only on loss of signal.
- Make clients reject large time steps instead of accepting them silently.
- Document a manual procedure for resetting time safely.
Keep it proportionate
CISA's guidance is to assume GPS data may not always be available or accurate when designing critical systems. That is a design rule, not a forecast of imminent failure.
Related: Solar storms and IT: what NOAA says can go wrong.
A worked example
Imagine a small data center with one rooftop GPS antenna feeding a network time server that every system uses. If the signal is jammed or spoofed, the server may drift or jump. Logs lose their order, short-lived tokens expire early or never, and replication can stall.
Fixing it does not need an exotic setup. Add a second time source, set clients to reject sudden large corrections, and alert when the time server reports bad signal quality. Then write down the manual steps to restore time, so the person on call is not improvising.
Finally, treat timing as an owned service. Assign a person or team to it, document the sources, and include it in your monitoring. Time problems are easy to miss because systems keep running while quietly drifting out of agreement.
Quick check
Is GPS only a navigation concern?
No. CISA lists timing as one of its three functions, and many systems rely on GPS for time.
Sources
Last reviewed: 19 October 2026.
