Which statement best describes the ongoing maintenance of time synchronization configurations under PCI DSS?

• A. Time synchronization is a one-time setup
• B. Time synchronization is optional
• C. Time synchronization is implemented and kept current, with verification against central time server settings
• D. Time synchronization is managed by end users

Answer: (C)

Time synchronization must be an ongoing practice, not a one-off setup. PCI DSS requires that system clocks are accurate across the environment so that logs time-stamp events consistently, enabling reliable correlation during monitoring and investigation. The best statement describes implementing time synchronization and keeping it current, with regular verification against a central time server. This ensures all devices align to a trusted time source, and drift is detected and corrected promptly.

Treating time synchronization as optional or leaving it to end users would lead to inconsistent timestamps and weak auditability, which PCI DSS explicitly aims to avoid.