Which of the following correctly defines MTTD, MTTR, and MTTC and their relationship?

• A. MTTD is the time from event occurrence to detection; MTTR is the time from detection to resolution; MTTC is the time from detection to containment; shorter MTTD improves MTTR and MTTC.
• B. MTTD measures containment speed; MTTR measures time to detection; MTTC measures time to resolution.
• C. MTTD is the time from detection to containment; MTTR from containment to resolution; MTTC from event to detection.
• D. MTTD is the time to patch systems; MTTR is the time to report; MTTC is the time to triage.

Answer: (A)

These three incident metrics measure different phases of an incident lifecycle: Mean Time To Detect, Mean Time To Repair, and Mean Time To Contain. MTTD is the time from when the event actually occurs to when it is first detected. MTTR is the time from detection to full restoration or resolution of the incident. MTTC is the time from detection to containment, meaning the period needed to isolate or limit the affected systems and stop further spread.

The option that matches this is the one where MTTD is defined as the time from event to detection, MTTR is the time from detection to resolution, and MTTC is the time from detection to containment. It also notes that a shorter MTTD helps shorten MTTC and MTTR because detecting the incident faster enables earlier containment actions and remediation efforts, reducing the overall impact and duration of the incident.

Other choices mix up the definitions—time to detection versus time to containment or resolution are swapped or misstated—so they don’t accurately describe what each metric measures or how they relate.