Mean time to report is the average elapsed time required to report a cybersecurity incident to relevant authorities or stakeholders. Shorter times indicate faster communication, while longer times signal a need for better reporting methods. section 6.3.2
Use the metric alongside mean time to detect, mean time to respond, and mean time to contain. Because MTTR can also mean mean time to respond, dashboards should label the reporting measure explicitly. section 6.3.2
Interpret the metric as an operational communication target:
- Set a reporting-time target and track how consistently incidents meet it. section 6.3.3
- Treat longer reporting times as evidence that communication methods or reporting protocols require improvement. section 6.3.2
- Compare reporting performance with detection, response, and containment times rather than interpreting it as a standalone security score. section 6.3.2
TechMed Solutions dashboard
TechMed Solutions set a mean time to report target of two hours or less within its risk assessment dashboard. The dashboard compared incident metrics before and after a risk management program, allowing leadership to review progress against defined targets and identify process improvements. section 6.3.3
Figure 6.6 On the left, the TechMed risk assessment dashboard before the risk management program is implemented. In this figure, the bottom metrics are displayed as a percentage to indicate the percentage of incidents that were within the predefined target of hours. For example, 40% of the incidents were detected within the 12-hour target detection time. On the right, the risk assessment dashboard after implementing the risk management program.
Use the before-and-after dashboard to inspect how target-based incident metrics communicate progress after risk management improvements. section 6.3.3
