Mean Time to Contain
What is Mean Time to Contain?
A metric measuring the average time from when a security incident is detected to when it is fully contained.
Frameworks that govern mean time to contain
What the standards actually require on mean time to contain
Requirements naming mean time to contain across this standard, quoted from the control text.
Report incident metrics including dwell time, mean time to detect, mean time to contain, mean time to recover, financial impact, and lessons trend analysis to executive risk committees.
PICERL-L-03 · Lessons Learned: Metrics and Reporting to Executives →Questions people ask about mean time to contain
What is Mean Time to Contain?
A metric measuring the average time from when a security incident is detected to when it is fully contained.
Why is Mean Time to Contain important for compliance?
Mean Time to Contain is a key concept in Information Security. Understanding mean time to contain helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Mean Time to Contain?
Mean Time to Contain appears in the requirement text of SANS Incident Handler's Handbook and PICERL Methodology. Across these standards we have identified 1 control that names it directly, each linked to the control text on the compliance platform.
Where can I learn more about Mean Time to Contain?
Explore our compliance framework pages to see how mean time to contain applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.
See how Mean Time to Contain applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.
Written and maintained by Gerard Blokdyk, The Art of Service.