A system clock is protected by limiting clock changes, change frequency, and calculating skew. System and secure clocks are initialized to a same time. First and second thresholds are set. The first threshold corresponds to an alert and the second threshold corresponds to an action. At a time interval at which the secure clock is to be updated, a skew is calculated between the system and secure clocks, and a cumulative skew is calculated. Upon a determination that the cumulative skew has reached the first threshold, but not the second threshold, the alert is triggered while deletions of files having retention locks that have expired according to the system clock are allowed to continue. Upon a determination that the cumulative skew has reached the second threshold, the action is triggered. The action includes blocking the deletions of files having retention locks that have expired according to the system clock.