What it means
Common measures include mean time to detect, acknowledge, respond, contain, repair, recover, and restore, as well as mean time between failures. The same abbreviation can mean different things across teams, so the event that starts and stops the clock must be defined explicitly.
How it works
Averages can hide severe outliers, different incident classes, clock pauses, and incomplete records. Mature programs pair mean values with medians, percentiles, severity bands, service objectives, and narrative review. Metrics should help improve capability rather than encourage teams to close records prematurely.
A team reports a two-hour mean time to respond, but one critical incident waited twelve hours while many low-severity alerts were handled in minutes. Segmenting by severity and showing the 90th percentile reveals the operational risk more clearly.
Practical focus
- Define every metric's start, stop, pause, and inclusion rules
- Segment by severity, service, detection source, and incident type
- Use distributions and percentiles alongside averages
- Audit data quality and investigate outliers
Common mistakes
- Comparing teams that use different clock definitions
- Rewarding speed without considering accuracy or containment quality
- Using one global average to describe unlike events
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: