Containment time is the elapsed time from detecting an incident to containing it. Mean time to contain (MTTC, also called MTTC-I) averages that interval across incidents. A shorter time indicates faster containment and less opportunity for an incident to affect systems or data. section 9.5.2 section 9.9.1 section 6.3.2
Read containment time alongside other response measures:
- Detection concerns finding an incident; containment concerns limiting its effects after detection. section 6.3.2
- Resolution extends through recovery, so a contained incident is not necessarily resolved. section 9.5.2
- Compare the average with a stated target, but do not confuse it with the percentage of incidents meeting that target. section 6.3.3
A before-and-after decision
A cybersecurity firm averaged eight hours to contain an incident while facing prolonged downtime and potential data loss. After refining its incident response plan and processes, the average fell to three hours. That improvement indicates faster containment; recovery time and response success rate still need separate review. section 9.9.1
Figure 6.6 On the left, the TechMed risk assessment dashboard before the risk management program is implemented. In this figure, the bottom metrics are displayed as a percentage to indicate the percentage of incidents that were within the predefined target of hours. For example, 40% of the incidents were detected within the 12-hour target detection time. On the right, the risk assessment dashboard after implementing the risk management program.
The dashboard compares response metrics before and after a risk management program. Its percentage displays show the share of incidents within a time target, not the mean containment time. section 6.3.3
