In OT security, which metric is used to measure the time it takes to resolve an incident?

In OT security, which metric is used to measure the time it takes to resolve an incident?

• A. Detection coverage
• B. False-positive rate
• C. MTTR
• D. Coverage of critical assets

Answer: (C)

MTTR, or Mean Time to Resolve, is the measure that captures how quickly an incident is handled from detection through to full resolution. In OT security, the speed of containment, eradication, and recovery directly impacts safety and uptime, so this metric best reflects incident-response efficiency. Detection coverage looks at how much of the environment you monitor, not how fast you fix issues. False-positive rate deals with alert accuracy, not response speed. Coverage of critical assets shows protection scope, not how quickly you resolve incidents. Tracking MTTR helps you identify where delays occur in the response process and drive improvements like better playbooks, automation, and coordinated responses.

MTTR, or Mean Time to Resolve, is the measure that captures how quickly an incident is handled from detection through to full resolution. In OT security, the speed of containment, eradication, and recovery directly impacts safety and uptime, so this metric best reflects incident-response efficiency. Detection coverage looks at how much of the environment you monitor, not how fast you fix issues. False-positive rate deals with alert accuracy, not response speed. Coverage of critical assets shows protection scope, not how quickly you resolve incidents. Tracking MTTR helps you identify where delays occur in the response process and drive improvements like better playbooks, automation, and coordinated responses.