Detection and response identifies security threats and acts quickly to minimize damage. It mitigates risk through systems and processes such as intrusion detection, security audits, and dedicated incident response teams. section 5.3.1
Effective detection and response depends on measurable performance targets:
- Mean time to detect (MTTD) measures how quickly incidents are identified; TechMed Solutions targeted six hours or less. section 6.3.3
- Mean time to contain (MTTC) measures how quickly threats are controlled; the target was one hour or less. section 6.3.3
- Mean time to respond (MTTR) measures response speed; the target was two hours or less, though results still needed improvement. section 6.3.3
- Automated monitoring, trained security staff, regular reviews, and coordinated patching can improve detection and containment. section 6.3.3
TechMed Solutions
After implementing a risk management program, TechMed Solutions reduced incident-detection and containment times. Its dashboard showed an MTTD of six hours and an MTTC of one hour, while a two-hour MTTR still indicated a need to streamline response protocols. Automated monitoring and continuous team training supported the improvement. section 6.3.3
Figure 6.6 On the left, the TechMed risk assessment dashboard before the risk management program is implemented. In this figure, the bottom metrics are displayed as a percentage to indicate the percentage of incidents that were within the predefined target of hours. For example, 40% of the incidents were detected within the 12-hour target detection time. On the right, the risk assessment dashboard after implementing the risk management program.
Compare the TechMed risk assessment dashboard before and after its risk management program, including the percentage of incidents meeting predefined time targets. section 6.3.3
