If companies wish to prove they comply with laws governing the handling of information, they must prove they can show when something happened, not simply that it happened — such as when someone accessed a file, created a document, sent an email or logged onto a system. That’s why laws like the Sarbanes-Oxley Act, the Health Insurance Portability and Accountability Act (HIPAA), FINRA’s Order Audit Trail System (OATS), the FDA’s Code of Federal Regulations (CFR), and the Payment Card Industry – Data Security Standards (PCI-DSS) are rife with regulations concerning the accuracy and trustworthiness of time stamps.

Sarbanes-Oxley requires public companies to assess the accuracy and reliability of systems in order to show who accessed what system logs, when and for how long. HIPPA protects patient privacy in part by regulating how hospitals, medical practices and payers use time stamps to control and audit system access. OATS requires that the time stamps on specific data elements related to the handling or execution of orders be within one second of the National Institute of Standards and Technology (NIST) atomic clock. CFR-21, Part 11 requires pharmaceutical manufacturers to employ procedures and controls to ensure the authenticity, integrity and confidentiality of electronic records. Those include measures to ensure the accuracy of computer generated time stamps.

Timekeeping and Credit Card Security
The most far-reaching regulation, however, may be PCI-DSS in that it impacts every merchant that signs an agreement to accept credit or debit cards. PCI-DSS is the creation of the Payment Card Industry Security Standards Council, an organization made up of payment card providers that sets the industry’s security requirements. As of December 31, 2007, all merchants as well as credit and debit card payment processors must adhere to PCI Data Security Standards or face substantial fees, fines, and penalties. The amounts are very high and can be especially damaging for smaller merchants.

Requirement 10 — which mandates how companies should “track and monitor all access to network resources and cardholder data” — requires that whenever cardholder data or a system object is accessed that there is an audit trail for each such event that includes:

• User ID
• Event type
• Date and time
• Success or failure
• Origination of the event
• Identity or name of affect data, system component or resource

Requirement 10 also mandates specific steps companies must take to ensure time stamp accuracy — for example, that the network time server is running the most recent version of NTP and that links to external NTP services are protected from hacker exploit.

The common thread that runs through all these regulations is that it’s much harder to create a compliant environment — regardless of industry — without a modern, secure timekeeping infrastructure on which to build.

If your network falls under any of these compliance requirements, consider adding a Symmetricom SyncServer® to precisely time your network infrastructure. Learn more about how network time servers enable compliant timekeeping infrastructures.

This post was published in Symmetricom’s ThinkSync newsletter, January 2012.
For more information, see our NTP Servers page.