STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

DISA Rule

SV-222498r508029_rule

Vulnerability Number

V-222498

Group Title

SRG-APP-000374

Rule Version

APSC-DV-001260

Severity

CAT II

CCI(s)

CCI-001890 - The information system records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

Weight

Fix Recommendation

Configure the application to use the underlying system clock that maps to relevant UTC or GMT timezone.

Check Contents

Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.

Identify the application components and the logs associated with the components.

If the application utilizes the underlying OS system clock, and the system clock is mapped to UTC or GMT, this is not a finding.

Identify where clock settings are configured within the application.

Access the configuration settings and determine if the application is configured to set the time stamps for audit records according to UTC or GMT (e.g., East coast standard time is represented as GMT -5, east coast daylight savings time is represented as GMT-4).

If the application is not configured to map to UTC or GMT, this is a finding.

The application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments