---

id: "IR-04(04)" title: "Information Correlation" family: "IR" family_name: "Incident Response" sort_id: "ir-04.04" priority: "P2" implementation_level: "organization" parent: "IR-04" enhancement: True

---

Statement

Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.

Guidance

Sometimes, a threat event, such as a hostile cyber-attack, can only be observed by bringing together information from different sources, including various reports and reporting procedures established by organizations.

Assessment Objective

incident information and individual incident responses are correlated to achieve an organization-wide perspective on incident awareness and response.

Incident response policy

procedures addressing incident handling

incident response plan

privacy plan

mechanisms supporting incident and event correlation

system design documentation

system configuration settings and associated documentation

system security plan

privacy plan

incident management correlation logs

event management correlation logs

security information and event management logs

incident management correlation reports

event management correlation reports

security information and event management reports

audit records

other relevant documents or records

Organizational personnel with incident handling responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with whom incident information and individual incident responses are to be correlated

Organizational processes for correlating incident information and individual incident responses

mechanisms that support and or implement the correlation of incident response information with individual incident responses