CompTIA CySA+ (CS0-003)Reporting and CommunicationEasy
A security analyst is drafting an incident report for a successful ransomware attack that encrypted several critical file servers. The incident response team managed to recover all data from backups and restore services within 24 hours. The report needs to highlight the effectiveness of the incident response plan and the team's performance. Which of the following KPIs would be MOST appropriate to demonstrate this success to management?
- ANumber of security awareness training sessions conducted.
- BTotal number of ransomware variants detected.
- CMean Time To Recover (MTTR) for critical services.
- DPercentage of endpoint detection and response (EDR) agents deployed.
Show answer & explanationAnswer & explanation
Correct answer: C. Mean Time To Recover (MTTR) for critical services.
Mean Time To Recover (MTTR) directly measures how quickly an organization can restore services after an incident. A MTTR of 24 hours for a ransomware attack demonstrates highly effective incident response and recovery capabilities.
Why the other options are wrong
- A. Security awareness training is a preventative measure, not a metric of incident response or recovery effectiveness.
- B. This metric relates to detection capabilities, not the success of recovery efforts after an attack.
- D. EDR agent deployment is a measure of security posture and coverage, not a direct indicator of incident recovery success.
Mean Time To Recover (MTTR)
The average time it takes to fully restore systems, applications, and services to normal operating conditions after a failure or incident.
- Crucial for business continuity and disaster recovery.
- Lower MTTR indicates effective recovery processes and resources.
- Often a key metric in incident response reporting to management.
Memory trick: Recovery is all about 'Getting Back to Business, Fast'.