‍

MTTR is all about looking at where you're handing your information over to the people who are responsible for fixing it. It's only fair to be able to measure time to response from the point where something has been handed over to somebody with some responsibility to see it through its life cycle.

‍

Once vulnerabilities are owned by somebody within the business, you can start a clock. When you then stop that clock and say that you have responded to something will depend on your organisation and the kind of thresholds that you have.

‍

You can say that you've responded to something when you've implemented the first line of defence in depth control or first compensating control. This has technically treated the issue in some part.

‍

However, it may be more accurate to measure MTTR in two different ways: your corrective action, and your preventative action. Then, you can calculate MTTR in addressing some sort of fix, and MTTR in addressing the systemic problem that's causing those vulnerabilities to appear in the first place.

‍