BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

SI-04(16) Correlate Monitoring Information

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
first version loaded SI part of SI-4

Title

Correlate Monitoring Information

Control

Correlate information from monitoring tools and mechanisms employed throughout the system.

Discussion

Correlating information from different system monitoring tools and mechanisms can provide a more comprehensive view of system activity. Correlating system monitoring tools and mechanisms that typically work in isolation—including malicious code protection software, host monitoring, and network monitoring—can provide an organization-wide monitoring view and may reveal otherwise unseen attack patterns. Understanding the capabilities and limitations of diverse monitoring tools and mechanisms and how to maximize the use of information generated by those tools and mechanisms can help organizations develop, operate, and maintain effective monitoring programs. The correlation of monitoring information is especially important during the transition from older to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols).

Related controls

au-6

Assessment objective

SI-04(16) information from monitoring tools and mechanisms employed throughout the system is correlated.

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).