Mean Time to Detect (MTTD) is the most appropriate Key Performance Indicator (KPI) to monitor the effectiveness of an incident response reporting and communication program among the choices provided.
Why B is correct: The primary goal of an "incident reporting" program (whether automated by tools or reported by users/staff) is to alert the security team to an issue as quickly as possible. MTTD measures the average time it takes for an organization to identify (detect and report) an incident after it has occurred. A lower MTTD directly indicates that the reporting mechanisms and communication channels from the source to the analysts are operating effectively.
Why A is incorrect:Incident volume measures the quantity of incidents, which reflects the threat landscape or workload rather than the effectiveness of the response program itself. While an increase in user-reported volume can indicate better awareness, MTTD is the standard performance metric for the process.
Why C is incorrect:Average time to patch is a KPI for Vulnerability Management, not Incident Response reporting.
Why D is incorrect:Remediated incidents refers to the volume of resolved issues (Response/Recovery phase) and does not specifically measure the speed or quality of the reporting and communication (detection) phase.
In Domain 4 (Reporting and Communication) and Domain 1 (Security Operations), CompTIA emphasizes the use of time-based metrics to evaluate process maturity.
MTTD (Mean Time to Detect): Measures "dwell time" and the efficiency of the Detection & Reporting phase.
MTTR (Mean Time to Respond): Measures the efficiency of the Response & Recovery phase.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit