Information Correlation
LOW MODERATE ✓ HIGHRequirements NIST SOURCE
Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
Discussion (NIST Supplemental Guidance)
Sometimes, a threat event, such as a hostile cyber-attack, can only be observed by bringing together information from different sources, including various reports and reporting procedures established by organizations.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for IR-4(4) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- incident information and individual incident responses are correlated to achieve an organization-wide perspective on incident awareness and response.
Examine
[SELECT FROM: Incident response policy; procedures addressing incident handling; incident response plan; privacy plan; mechanisms supporting incident and event correlation; system design documentation; system configuration settings and associated documentation; system security plan; privacy plan; incident management correlation logs; event management correlation logs; security information and event management logs; incident management correlation reports; event management correlation reports; security information and event management reports; audit records; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with incident handling responsibilities; organizational personnel with information security and privacy responsibilities; organizational personnel with whom incident information and individual incident responses are to be correlated].
Test
[SELECT FROM: Organizational processes for correlating incident information and individual incident responses; mechanisms that support and or implement the correlation of incident response information with individual incident responses].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for IR-4(4). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Incident response policy
- incident response plan
- privacy plan
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Organizational processes for correlating incident information and individual incident responses
- mechanisms that support and or implement the correlation of incident response information with individual incident responses
Other Records
- procedures addressing incident handling
- mechanisms supporting incident and event correlation
- incident management correlation logs
- event management correlation logs
- security information and event management logs
- incident management correlation reports
- event management correlation reports
- security information and event management reports
- audit records
- other relevant documents or records