IR-4(4): Information Correlation

Control Family:

Incident Response

Parent Control:

IR-4: Incident Handling

CSF v1.1 References:

Baselines:

  • High

Previous Version:

Control Statement

Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.

Supplemental Guidance

Sometimes, a threat event, such as a hostile cyber-attack, can only be observed by bringing together information from different sources, including various reports and reporting procedures established by organizations.