IR-4(4): Information Correlation

Control Family:

Incident Response

Parent Control:

IR-4: Incident Handling

Priority:

CSF v1.1 References:

Baselines:

  • High

Next Version:

Control Statement

The organization correlates incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.

Supplemental Guidance

Sometimes the nature of a threat event, for example, a hostile cyber attack, is such that it can only be observed by bringing together information from different sources including various reports and reporting procedures established by organizations.