NIST Cybersecurity Framework 2.0 NIST-CSF-DE.AE-03: Information is correlated from multiple sources

What else in your programme already covers this

This control maps to 63 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 8 controls

NIST800-AC-23 AC-23 Data Mining Protection
NIST800-AU-6 AU-6 Audit Record Review, Analysis, and Reporting
NIST800-CA-3 CA-3 Information Exchange
NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-IR-5 IR-5 Incident Monitoring
NIST800-RA-10 RA-10 Threat Hunting
NIST800-SI-22 SI-22 Information Diversity
NIST800-SI-4 SI-4 System Monitoring

FedRAMP High · 7 controls

AU-6(3) Correlate Audit Record Repositories
SA-2 Allocation of Resources
SI-4 System Monitoring
SI-4(1) System Monitoring | System-wide Intrusion Detection System (SI-4(1))
SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16))
SI-4(4) Inbound and Outbound Communications Traffic
SI-7(7) Integration of Detection and Response

FedRAMP Moderate · 7 controls

AU-6(3) Correlate Audit Record Repositories
SA-2 Allocation of Resources
SI-4 System Monitoring
SI-4(1) System Monitoring | System-wide Intrusion Detection System (SI-4(1))
SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16))
SI-4(4) Inbound and Outbound Communications Traffic
SI-7(7) Integration of Detection and Response

CIS Controls v8 · 4 controls

CIS-13.1 Centralize Security Event Alerting
CIS-13.6 Collect Network Traffic Flow Logs
CIS-8.2 Collect Audit Logs
CIS-8.9 Centralize Audit Logs

ISO 27001:2022 · 4 controls

5.25 Assessment and decision on information security events
5.7 Threat intelligence
8.15 Logging
8.16 Monitoring activities

Australian Information Security Manual · 3 controls

ISM-0988 Consistent time source for event logs
ISM-1405 Implementing a centralised event logging facility
ISM-1959 Consistent structured event log format

SOC 2 · 3 controls

SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13)
SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
SOC2-CC7.2 CC7.2 Monitoring system components for anomalies

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-30 Endpoint detection and response (Very Good)
ASD37-31 Hunt to discover incidents (Very Good)

ASIC Cyber Resilience Good Practices · 2 controls

ASIC-CR-DE-1 Continuous monitoring with SIEM
ASIC-CR-DE-2 Data analytics for threat integration

AWS Well-Architected Security Pillar · 2 controls

SEC04-BP02 Capture logs, findings, and metrics in standardized locations
SEC04-BP03 Correlate and enrich security alerts

Azure Security Benchmark · 2 controls

ASBv3-IR-4 Detection and analysis - investigate an incident
LT-5 Centralize security log management and analysis

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-LOG-03 Security Monitoring and Alerting
CCM-LOG-05 Audit Logs Monitoring and Response

HIPAA Security Rule · 2 controls

164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.312(b) Audit Controls (Standard)

NIST SP 800-171 Rev 3 · 2 controls

03.03.01 Event Logging
03.03.06 Audit Record Reduction and Report Generation

NIST SP 800-172 · 2 controls

3.11.3e Advanced Automation and Analytics Capabilities
3.14.6e Use Threat Indicator Information for Detection

NIST SP 800-66 Rev 2 · 2 controls

164.308(a)(1)(ii)(D) Information System Activity Review (Required)
164.312(b) Audit Controls (Standard)

PCI DSS 4.0 · 2 controls

10.3.3 10.3.3 Audit logs promptly backed up to central secure storage
10.4.1.1 10.4.1.1 Automated mechanisms used for audit log review

C5 (Germany) · 1 control

C5-OPS-10 Logging and Monitoring - Concept

CMMC 2.0 · 1 control

AU.L2-3.3.5 Audit Correlation

NIST Cybersecurity Framework 1.0 · 1 control

DE.AE-3 DE.AE-3: Event data are aggregated and correlated from multiple sources and sensors

NIST Cybersecurity Framework 1.1 · 1 control

DE.AE-3 DE.AE-3: Event data are collected and correlated from multiple sources and sensors

NIST SP 800-161 Rev 1 · 1 control

161R1-AU-16 Cross-Organizational Audit Logging

NIST SP 800-61 Rev. 3 · 1 control

DE.AE-03 DE.AE-03 Logs centralized and events correlated across sources

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done?

NIST Cybersecurity Framework 2.0 NIST-CSF-DE.AE-03 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.

If you hold ISO 27001:202268.9% covered · 33 gaps If you hold NIST SP 800-53 Rev 567.9% covered · 34 gaps If you hold C5 (Germany)67% covered · 35 gaps If you hold FedRAMP Moderate63.2% covered · 39 gaps If you hold ISO 27002:202258.5% covered · 44 gaps If you hold CIS Controls v853.8% covered · 49 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free