CompTIA CySA+ (CS0-003)Reporting and CommunicationEasy
A security analyst is preparing a quarterly report for the Chief Information Security Officer (CISO). The CISO is particularly interested in understanding the organization's ability to quickly restore normal operations after a disruptive security incident. Which of the following metrics would BEST address the CISO's concern?
- AMean Time To Recover (MTTR)
- BMean Time To Resolve (MTTR)
- CMean Time To Detect (MTTD)
- DMean Time To Contain (MTTC)
Show answer & explanationAnswer & explanation
Correct answer: A. Mean Time To Recover (MTTR)
Mean Time To Recover (MTTR) specifically measures the average time it takes to restore systems and operations to normal functionality after an incident, directly addressing the CISO's concern about restoring normal operations.
Why the other options are wrong
- B. Mean Time To Resolve (MTTR) is sometimes used interchangeably with recover, but 'Recover' specifically targets restoration of operations.
- C. MTTD measures how long it takes to identify an incident, not to recover from it.
- D. MTTC measures how long it takes to stop an incident from spreading, not to fully recover.
Mean Time To Recover (MTTR)
A key performance indicator that measures the average time it takes for an organization to restore systems, services, and operations to their normal functionality after a disruption or failure.
- Focuses on restoration of service.
- Calculated from the start of recovery efforts to full operational status.
- Crucial for business continuity and disaster recovery planning.
Memory trick: DRC: Detect, Contain, Recover.