Mean Time to Respond (MTTR, sometimes written as Mean Time to Response) is the average time required to return a system to operational condition after receiving notification of a failure or cyberattack.
MTTR characterizes the functional security of devices and software products and can be used to assess the performance of a team of information security specialists. The Mean Time to Respond does not take into account the time when a problem was already in existence but unknown. That period is called the Mean Time to Detect (MTTD). Combined, the MTTR and MTTD make up the total duration of a cyberincident.
How to calculate MTTR
To calculate MTTR, collect data on all incidents for a particular period, add up the time spent on restoring the system from the moment the signal about the problem was received, and then divide the total by the number of incidents.
Example: A company experiences three cyberincidents over the course of a month. It took 20 minutes to mitigate the first incident, 32 minutes for the second, and 44 minutes for the third. The MTTR for the month is (20 + 32 + 44)/3 = 32 minutes.
Other meanings of the abbreviation MTTR
MTTR can also refer to other indicators that are similar but not identical:
- Mean Time to Repair is the average time from starting maintenance work to restoring the system and verifying its performance;
- Mean Time to Recover is the average time from failure to full recovery;
- Mean Time to Resolve is the average time for an incident to be resolved completely, including detecting the problem, correcting the consequences, and taking measures to prevent the event from recurring.