RDEM Systems / Operator Notes Stratum 1 · GNSS · NTS EN FR
NTP test & audit toolkit · No signup · No telemetry

Online NTP Validator — Test NTP servers & validate compliance.

Test any NTP server (public or RFC 1918 private) against our GNSS-disciplined Stratum 1 references — then turn the results into audit evidence for ISO 27001 A.12.4.4, NIS 2 Art. 21, PCI-DSS Req. 10.6 and DORA.

Built and operated by Richard Demongeot — running NTP infrastructure since 2005, Pontoise, France.

Test Mode Selection

Three test modes — pick the one matching your scope. All produce evidence aligned with ISO 27001 A.12.4.4, NIS 2 Art. 21 and PCI-DSS Req. 10.6.

Basic Time Test

Browser-side check of your system time vs Stratum 1 GNSS. Audit-ready report.

NTP Bridge Test (RFC 1918)

Test internal NTP servers on private networks (10/8, 172.16/12, 192.168/16).

CLI Testing Script

Bash script for server-side compliance verification and evidence collection.

Basic Time Test

Test your system time against RDEM GNSS-disciplined Stratum 1 references — a prerequisite for ISO 27001, NIS 2 and DORA audit trails.

04 — REFERENCE CHECKLIST

15 controls auditors actually check.

What an ISO 27001 or NIS 2 auditor looks for when reviewing your NTP stack. The PDF is printable, dated, and produced from this same operator log.

Infrastructure
  • Multiple NTP sources configured (≥4)
  • Stratum 1 or 2 servers used
  • Geographic diversity of sources
  • Internal NTP hierarchy defined
  • Failover mechanisms in place
Security
  • UDP 123 firewall rules documented
  • NTP amplification protection
  • Access control lists configured
  • Monitoring and alerting active
  • Logs retained per policy
Validation
  • Offset within acceptable range
  • No false tickers detected
  • Reach value at 377
  • Regular sync verification
  • Documentation up to date
Download the PDF checklist

Printable format, ideal for audit evidence files

By downloading, you agree to receive information about our NTP services. Unsubscribe anytime.

05 — DIFFERENT ANGLE?

Pick the right tool for the job.

This site tests NTP servers with an audit and compliance angle. For other angles, our sister sites do better:

Measure jitter, offset, latency ntp-tester.eu →
Diagnose firewall / port 123 / daemon issues check-ntp.net →
Enterprise reference architecture ntp.rdem-systems.com →

Frequently asked questions

What are the NTP requirements under NIS 2?

NIS 2 Article 21 mandates accurate, authenticated time-sources for audit-trail integrity in essential and important entities. In practice: at least four geographically-diverse Stratum 1 or 2 sources, authenticated via NTS (RFC 8915), with dispersion monitoring and 13-month log retention. Our audit checklist covers the full NIS 2 time-sync control set.

How does NTP compliance map to ISO 27001 A.12.4.4?

ISO 27001:2022 control A.12.4.4 (Clock Synchronisation) requires all information-processing systems to synchronise to a single reference time-source. Evidence expected by auditors: documented NTP hierarchy, source authentication, offset monitoring, and alerting on stratum-16 or false-ticker events. This validator produces audit-ready reports aligned with that control.

Can I audit internal RFC 1918 NTP servers without public exposure?

Yes — this is what the RFC 1918 Bridge mode is designed for. A lightweight Node.js relay running on your audit workstation proxies NTPv4 packets to private-range servers (10/8, 172.16/12, 192.168/16). No data leaves your network. Results include stratum, offset, RTD, reference ID and leap indicator — the evidence set required by ISO 27001 and NIS 2 auditors.

Does DORA impose specific NTP requirements for financial entities?

DORA (Regulation EU 2022/2554) requires financial entities to maintain ICT integrity including verifiable timestamping of transactions and incident records. While DORA does not name NTP explicitly, its operational resilience and forensic-evidence requirements effectively mandate authenticated, redundant, monitored time-sync — which NTS over Stratum 1 infrastructure provides.

What evidence do auditors expect from an NTP compliance review?

Auditors typically ask for: (1) list of configured NTP sources with stratum levels, (2) offset and jitter measurements over a representative window, (3) authentication configuration (NTS / symmetric-key), (4) monitoring/alerting rules for stratum-16 and false-ticker conditions, (5) change-management records for NTP configuration. Our downloadable checklist maps these to ISO 27001, NIS 2, PCI-DSS and DORA controls.