Skip to content

Mean Time to Detect

What is Mean Time to Detect?

A metric measuring the average time between the occurrence of a security incident and its detection by the organization.

Information Security

Frameworks that govern mean time to detect

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on mean time to detect

Requirements naming mean time to detect across 4 standards, quoted from the control text.

Japan FSA Cybersecurity Guidelines for Financial Institutions2 controls

Vulnerability Management is a core technical control area per FSA Cybersecurity Guidelines. (1) Vulnerability Discovery: (a) Authenticated and Unauthenticated Scanning - Nessus + Qualys + Rapid7 + open source; (b) DAST Dynamic Application Security Testing;

JP-FSA-CYB-Vulnerability-Management-Patching-CVE-Risk-Based-Prioritisation-Penetration-Testing-Red-Team · Japan FSA Cybersecurity Vulnerability Management + Patching + CVE Tracking + Risk-Based Prioritisation + Penetration Testing + Red-Team + Bug Bounty + Coordinated Vulnerability Disclosure + Zero-Day Response →
ISO/IEC 27004:20161 control

Measure number, severity, mean-time-to-detect, and mean-time-to-respond for security incidents.

27004-A.3 · Incident Measures →
NIST SP 800-1371 control

Define ISCM metrics per Section 3.2 covering security control effectiveness + system + organizational metrics + leading and lagging indicators + Cyber-Resilience metrics + KPIs (Mean Time to Detect MTTD + Mean Time to Respond MTTR + Mean Time to Remediate MTTR...

NISTSP137-2 · Monitoring Metrics, Measures, and Frequencies →
SANS Incident Handler's Handbook and PICERL Methodology1 control

Report incident metrics including dwell time, mean time to detect, mean time to contain, mean time to recover, financial impact, and lessons trend analysis to executive risk committees.

PICERL-L-03 · Lessons Learned: Metrics and Reporting to Executives →

Questions people ask about mean time to detect

What is Mean Time to Detect?
A metric measuring the average time between the occurrence of a security incident and its detection by the organization.
Why is Mean Time to Detect important for compliance?
Mean Time to Detect is a key concept in Information Security. Understanding mean time to detect helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Mean Time to Detect?
Mean Time to Detect appears in the requirement text of Japan FSA Cybersecurity Guidelines for Financial Institutions, ISO/IEC 27004:2016, NIST SP 800-137, SANS Incident Handler's Handbook and PICERL Methodology. Across these standards we have identified 5 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Mean Time to Detect?
Explore our compliance framework pages to see how mean time to detect applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Mean Time to Detect applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.