Authoritative Time Source

Specify one authoritative time source and point everything at it.

Objective [b] says an authoritative source, singular. Systems split across unrelated time sources invite the question of whether their logs can be compared. Name the source in your system security plan, the document that describes how your system meets each requirement. Where a device cannot use it, record the deviation and show the clocks still agree.

Most of this already works. The job is naming it and proving it.

Domain joined Windows machines sync through the domain hierarchy, and cloud platforms sync their own infrastructure. Network gear takes an NTP setting, the standard network time protocol. Objective [c] wants the comparing and synchronizing shown, so capture the time service status from a server and the NTP configuration page from your firewall.

You cannot set the clock on a cloud service, so document it instead.

A provider's platform clocks are outside your control. Record in the system security plan that the provider synchronizes its own infrastructure. Review logs in UTC, coordinated universal time, so records from different systems line up without time zone arithmetic during an investigation.