CSIRT/SIRT Performance Indicators
KPIs for measuring the team
Without metrics, it's impossible to demonstrate a CSIRT's value to leadership or identify where the process is failing. The most common indicators include mean time to detect (MTTD), mean time to respond and contain (MTTR), the volume of incidents by severity and type, and the percentage of incidents resolved within the defined SLA. It's also worth measuring quality indicators, such as the false positive rate generated by alerts or the percentage of incidents that had to be reopened due to incomplete containment. These KPIs should be reviewed periodically together with leadership, not just to report results, but to justify adjustments to staff, tools or processes when the metrics show a sustained negative trend over time.