Certified Information Security Manager (CISM)Incident ManagementMedium
A CISO is reviewing the organization's incident response metrics. The metrics currently track the total time from incident detection to full resolution. To improve the effectiveness of the detection phase and identify potential weaknesses in monitoring systems, which of the following metrics should the CISO additionally prioritize?
- AMean Time To Recover (MTTR)
- BMean Time To Detect (MTTD)
- CMean Time Between Failures (MTBF)
- DMean Time To Contain (MTTC)
Show answer & explanationAnswer & explanation
Correct answer: B. Mean Time To Detect (MTTD)
Mean Time To Detect (MTTD) specifically measures the average time it takes to identify an incident from its inception. Prioritizing this metric directly addresses the effectiveness of the detection phase and helps pinpoint weaknesses in monitoring systems and early warning capabilities.
Why the other options are wrong
- A. MTTR measures recovery speed, not detection effectiveness.
- C. MTBF is a reliability metric for systems, not an incident response metric.
- D. MTTC measures containment speed, not initial detection effectiveness.
Mean Time To Detect (MTTD)
The average time it takes an organization to identify a security incident from the moment it began.
- Measures the efficiency of monitoring and alerting systems.
- A lower MTTD indicates better visibility and faster initial response.
- Crucial for minimizing the impact of incidents by enabling early action.
Memory trick: To catch a thief, you first need to 'Detect' they're there.