Communicate Incident Response Metrics and KPIs

Question 1

MTTD

Answer 1

Mean time to detect - a measurement of the average time from when an incident starts and the time taken to become aware of the vulnerability.

Question 2

MTTI

Answer 2

Mean time to identify - The average measure of time for the initial response to a potential security incident

Question 3

MTTR

Answer 3

Mean time to respond - a measurement of the average time taken for the initial response to a potential security incident.

Question 4

MTTC

Answer 4

Mean time to contain - a measurement of time to quarantine a potential security incident

Question 5

MTTR (Remediate)

Answer 5

Mean time to remediate - a measurement of the average time taken to close the vulnerability that triggered the incident response

Question 6

MTTR (Recover)

Answer 6

Mean time to recovery - a measurement of the average time it takes to restore operations to a pre-security incident state.

Question 7

Alert Volume

Answer 7

Alert volume - the amount of notifications indicating a potential security incident. The greater the amount of notifications can lead to “alert fatigue”. It can be challenge to determine the critical alerts from low priority alerts.