WHAT ARE INCIDENT RESPONSE METRICS AND WHY ARE THEY IMPORTANT?
About This Control
Summary: Incident Response Metrics reports on containment and remediation times for security incidents. That is, the time needed to contain the incident and keep it from spreading, and the time needed to recover from the incident and restore normal operations.
Why It Matters
Incident Response enables the organization to contain the impact and spread of a cybersecurity event, and then to recover systems back to normal status.
It helps to limit business impact by containing threats more quickly, and consequently reducing downtime, data loss, and regulatory exposure.
It aids in preserving trust by showing the organization has prepared for responding to security events.
Risks Addressed
Without viable incident response, a cybersecurity incident can lead to an extended business outage, increased data loss, and other negative impacts that accumulate the longer the incident goes uncontained and unresolved. Tracking containment and remediation times shows if these times are, on average, within the expected targets.
It helps to limit the extent of data breaches, the spread of ransomware, and the consequences of privilege abuse.
Escalating financial, legal, and reputational damage are risks that increase if there are missed detection, containment, or notification obligations.
CONTROLS THIS DASHBOARD REPORTS ON
Frameworks: This dashboard intersects with these controls as they apply to Incident Response, and as the controls are implemented by the organization.
NIST CSF v2.0: ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
PCI-DSS v4.0.1: 12.10.1 An incident response plan exists and is ready to be activated in the event of a suspected or confirmed security incident.
CIS CSC v8.1: Control 17 Incident Response Management
PRIMARY KEY PERFORMANCE INDICATOR (KPI)
The dashboard reports on this Primary KPI:
Numerator: Number of security incidents that were remediated (i.e., resolved) within the expected SLA.
Denominator: Total number of security incidents.
COLUMNS DISPLAYED ON THE DETAIL DASHBOARD
Leading: Compliance Status, Ticket Category, Ticket Close Code, Ticket Number
Ticket-info: Ticket Incident Description, Ticket Opened By, Ticket Priority
Ticket-state: Ticket Severity, Ticket Status
Asignee-info: Ticket Assigned To, Ticket Assignment Group
Time: Ticket Closed Time, View Calculated Ticket Contained Time, Ticket Created Time, Ticket Modified Time, Ticket Resolved Time
Compliance info as calculated in the view: View Calculated Ticket Has Breached, View Calculated Time To Containment Minutes, View Calculated Time To Remediation Hours
Compliance info as precalculated by the ticketing product: Precalculated Ticket Has Breached, Precalculated Calendar Duration Hours, Precalculated Business Duration Hours
Assignment_history: Assignment History
Org Hierarchy: Owner Email Address, Owner Employee Id, Owner Full Name, Owner Job Title, Manager Email Address, Manager Full Name, Level 1, Level 2, Level 3, Level 4, Level 5, Level 6
OCSF TABLES USED BY THE DASHBOARD
OCSF.INCIDENT_FINDING