QuestionQ12

Reporting and Communication

A security operations center manager is concerned that after-action reporting is not being completed in a timely manner. Which of the following metrics will allow the manager to quantify this concern?

  • A Mean time to remediate
  • B Mean time to close
  • C Mean time between failures
  • D Mean time to respond
Explanation

Mean Time to Close (MTTC) measures the total time from when an incident is detected to when it is fully closed out, including completion of documentation and after-action reports. Since the manager's concern involves the timeliness of after-action reporting—an activity that occurs during incident closure—MTTC is the metric that captures and quantifies delays in that phase, whereas mean time to respond and mean time to remediate track earlier stages (initial response and root-cause fixing), and mean time between failures is a hardware/system reliability metric unrelated to incident handling.

Community Discussion

No comments yet. Be the first to start the discussion!