STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

TOSS must, for networked systems, compare internal information system clocks at least every 24 hours with a server which is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

DISA Rule

SV-252928r1038944_rule

Vulnerability Number

V-252928

Group Title

SRG-OS-000355-GPOS-00143

Rule Version

TOSS-04-010180

Severity

CAT II

CCI(s)

• CCI-001890 - Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
• CCI-004923 - Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.
• CCI-004926 - Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period.

Weight

10

Fix Recommendation

For networked systems, configure TOSS to compare internal information system clocks at least every 24 hours with a server which is synchronized to one of the redundant USNO time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the GPS.

Add and/or modify the following line in the /etc/chrony.conf file:

server [ntp.server.name] iburst maxpoll 16

Check Contents

If the system is not networked, this requirement is Not Applicable.

The system clock must be configured to compare the system clock at least every 24 hours to the authoritative time source.

Check the value of "maxpoll" in the "/etc/chrony/chrony.conf" file with the following command:

$ sudo grep maxpoll /etc/chrony/chrony.conf
server tick.usno.navy.mil iburst maxpoll 16

If "maxpoll" is not set to "16" or does not exist, this is a finding.

Verify that the "chrony.conf" file is configured to an authoritative DOD time source by running the following command:

$ grep -i server /etc/chrony.conf
server tick.usno.navy.mil iburst maxpoll 16
server tock.usno.navy.mil iburst maxpoll 16
server ntp2.usno.navy.mil iburst maxpoll 16

If the parameter "server" is not set, is not set to an authoritative DOD time source, or is commented out, this is a finding.

Vulnerability Number

V-252928

Documentable

False

Rule Version

TOSS-04-010180

Severity Override Guidance

If the system is not networked, this requirement is Not Applicable.

The system clock must be configured to compare the system clock at least every 24 hours to the authoritative time source.

Check the value of "maxpoll" in the "/etc/chrony/chrony.conf" file with the following command:

$ sudo grep maxpoll /etc/chrony/chrony.conf
server tick.usno.navy.mil iburst maxpoll 16

If "maxpoll" is not set to "16" or does not exist, this is a finding.

Verify that the "chrony.conf" file is configured to an authoritative DOD time source by running the following command:

$ grep -i server /etc/chrony.conf
server tick.usno.navy.mil iburst maxpoll 16
server tock.usno.navy.mil iburst maxpoll 16
server ntp2.usno.navy.mil iburst maxpoll 16

If the parameter "server" is not set, is not set to an authoritative DOD time source, or is commented out, this is a finding.

Check Content Reference

M

Target Key

5469