Access-control investigations depend on knowing which event happened first. A door transaction, alarm video and intrusion record can describe the same incident with different timestamps when controllers drift or systems apply time zones inconsistently.
Map every clock in the event chain
Identify the time source used by the management server, database, field controllers, readers, video system and security operations platform. Record whether each device stores local time or Coordinated Universal Time and where daylight-saving conversion occurs.
Define the accepted offset for operational display and forensic correlation. A few seconds may be acceptable for routine access, while a tightly integrated video or interlock workflow may require a smaller tolerance.
Create a repeatable reference event
Use an approved test credential at a selected door while recording an independent trusted time reference. Generate a granted access, denied access, forced-door alarm and door-held-open alarm. Capture timestamps at the controller, server, audit database and operator display.
Repeat the test at a remote controller and a device that has recently restarted. Compare event creation time with event receipt time so network delay is not mistaken for clock error.
Test outages and resynchronization
Disconnect a controller under a controlled plan, allow it to record local transactions and then restore communications. Confirm that buffered events retain their original occurrence times and appear in the correct order after upload.
Restart time services and test a daylight-saving or time-zone boundary in a non-production environment where possible. Verify that duplicate or impossible timestamps are clearly handled rather than silently reordered.
Verify cross-system correlation
Compare access events with video bookmarks, intrusion alarms and visitor records. Confirm that an operator selecting an access event receives the correct camera interval. If integrations add their own timestamp, document which value is authoritative.
Time assurance should form part of wider Access Control & Identity governance, especially where logs support investigations or compliance reports.
Monitor drift over the lifecycle
Record offset by device and trend it over time. Alert on failed synchronization, large steps or controllers that repeatedly lose time after power interruption. Retest after firmware, network, directory or time-service changes.
Keep screenshots, raw logs and the trusted reference used during testing. Classify deviations as device-clock, conversion, transport or display errors. Correct the root cause and rerun the same event sequence before closing the issue.
Define ownership and escalation
Assign responsibility for enterprise time sources, controller configuration and integration mapping. When a drift alert appears, operators need a documented escalation path rather than an informal clock reset. Record the cause, affected interval and any evidence whose chronology may require qualification.
Include time integrity in routine health reporting. A synchronized server cannot compensate for a controller that has stopped accepting updates, and a correct controller clock does not prevent a receiving platform from applying the wrong time zone. Close findings only after an end-to-end event is repeated successfully.
Reference sources
