# How to Measure Incident Response Readiness with Metrics (2026)

> The metrics that show whether you are ready for an incident: MTTD, MTTR, time to escalate, time to a notification decision, exercise scores, decision accuracy, playbook coverage and action closure. Definitions, formulas, targets and where to get the data.

Source: https://playciso.com/blog/measure-incident-response-readiness-metrics · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

“Are we ready for a breach?” is the question boards ask most and security teams answer worst. Readiness is not a feeling or a policy count. It shows up in three places: how fast you handle real incidents, how well people perform in exercises, and how much of your plan has actually been tested. This guide defines the metrics in each, how to calculate them and where the data comes from. ## Which metrics show incident response readiness? MetricWhat it showsHow to calculateData source Time to detect (MTTD)How long attackers go unnoticedDetection time minus first malicious activity; median per quarterPost-incident reviews Time to escalateWhether the right person is woken quicklyIncident lead engaged minus detectionPaging and ticket logs Time to containSpeed of stopping the spreadContainment confirmed minus detectionIncident timeline Time to recover (MTTR)Speed back to normal operationRecovery minus detectionIncident timeline Time to notification decisionWhether legal deadlines are at riskDecision recorded minus “aware” timeDecision log Exercise rubric scoreTeam capability in a scenarioSum of 1–4 scores divided by maximum; compare repeated scenariosTabletop evaluator Decision accuracyIndividual judgement under pressureShare of decisions matching the best-practice answer in simulationsSimulation scorecards Playbook coverageHow much of the plan is testedPlaybooks exercised in last 12 months divided by total playbooksExercise calendar Deputy coverageSingle points of failureRoles with a trained deputy divided by rolesRACI and roster Action closure rateWhether lessons become changesImprovement actions closed by due date divided by actions dueAfter-action tracker ## How do you calculate MTTD and MTTR correctly? For each incident, record four times in UTC, from evidence: first malicious activity, detection, containment and recovery. Time to detect is detection minus first activity; time to contain and time to recover are measured from detection. MTTD and MTTR are the averages over a period, but use the **median** as the headline, because one long incident distorts a mean. Two common mistakes: measuring from when the ticket was opened rather than from the first malicious activity (which hides dwell time), and mixing minor and major incidents in one number. Report by severity. The [Post-Incident Review Template](/tools/post-incident-review-template) works out the per-incident times from the four timestamps. ## How do exercise scores measure capability? Real incidents are, thankfully, rare and different from each other, so they make poor capability measures on their own. Exercises fill the gap because you control the scenario. Three exercise metrics work: - Rubric scores. An evaluator scores six or seven criteria from 1 to 4 (decision authority, evidence preservation, containment order, notification, communications, documentation). Re-run the same scenario six to twelve months later and compare. The Tabletop Runbook Generator includes this rubric and turns the total into a readiness band. - Decision accuracy. Branching simulations score each decision. PlayCISO’s War Room grades executive incident decisions; the IR Playbook Lab scorecard reports accuracy per lifecycle phase, injects handled and critical failures (such as wiping before imaging). Track the team’s median, not individuals’ scores, so it stays no-fault. - Injects handled. How many surprises the team absorbed without losing the main thread, and how long each took. ## Which readiness assessments can you use as a baseline? AssessmentBest forWhyMain drawbackPrice (as of October 2026) PlayCISO Incident Response Readiness ScorecardA quick baseline across plan, playbooks and policies14 areas: master plan, 12 incident playbooks, supporting policies; shows the three weakestSelf-assessment; honest answers requiredFree PlayCISO SOC Maturity AssessmentSecurity operations capabilityStructured around the open SOC-CMM model’s five domainsEducational, not the official SOC-CMMFree NIST CSF 2.0 profile reviewProgramme-level alignmentNIST SP 800-61r3 maps incident response to all six CSF 2.0 functionsEffort to do wellFree framework External IR readiness assessmentIndependent assurance for boards and insurersExperienced assessors, comparison with peersCostQuote-based ## How do coverage metrics catch the gaps? A team can be fast on ransomware and untested on everything else. Coverage metrics show this. List every playbook on your [incident response topology](/incident-response) and mark the date each was last exercised. Count roles with a named, trained deputy using the [RACI & On-Call Roster Builder](/tools/incident-response-raci-builder). Test the contact list: call the out-of-hours numbers for your insurer, outside counsel and incident response retainer once a quarter. And track the improvement actions from every exercise and incident to closure; a low closure rate means exercises are not changing anything. ## What should go to the board? Five lines, each as a trend: median time to detect and contain for significant incidents; playbooks exercised in the last 12 months; the latest executive exercise score and its open actions; deputy coverage for critical roles; and the top three gaps with owners and dates. The [Board Metrics Selection Lab](/tools/board-metrics-lab) practises choosing board-grade metrics, and the [KPI library](/kpi-library?role=incident-response-lead) lists targets and SLAs for incident response leads. ## Which incident response metrics mislead? Some popular numbers say little about readiness. **Alert counts** rise when detection improves, so a bigger number can be good news. **Training completion rates** show attendance, not capability; a team can complete every module and still wipe a host before imaging it. **Mean time to respond with no definition** invites gaming: is it time to acknowledge an alert, to contain, or to recover? Write the definition next to the number. **Single exercise scores** depend on the scenario and the facilitator; only repeated scenarios are comparable. And **individual leaderboards** from exercises erode the no-fault culture that makes people report mistakes. Use team medians and keep individual scores private to the person. A useful test for any metric: if it moved by 20% next quarter, would you change what you do? If not, drop it from the report. ## Checklist: an IR readiness measurement programme - Baseline taken with a structured scorecard - Four UTC timestamps recorded for every significant incident - Medians reported by severity, per quarter - Same scenario re-run to compare rubric scores - Playbook and deputy coverage tracked - Improvement actions tracked to closure - Board sees trends and owned gaps, not alert counts ## Frequently asked questions ### How do you measure IR readiness with metrics? Combine outcome metrics from real incidents, capability metrics from exercises and coverage metrics from the programme, each reported as a trend, with a readiness self-assessment as the baseline. ### How do you calculate MTTD and MTTR? Per incident, detection minus first malicious activity, and recovery minus detection; then take the median across incidents in the period, using UTC times from evidence. ### What is a good incident response readiness score? No universal benchmark exists. Set a baseline and aim for steady improvement: fewer weak areas, higher repeated-exercise scores and more actions closed on time. ### What should be reported to the board about incident response readiness? Trends in time to detect and contain, playbooks exercised, the last executive exercise and its open actions, and the top three gaps with owners and dates.