Senior management wants to know whether the organization's ability to handle incidents is improving over time. Which metrics would BEST support this?

Metrics for incident management should show whether the capability is becoming more effective at limiting impact, which depends largely on how quickly incidents are detected and how quickly they are contained and resolved. Mean time to detect measures how long threats operate before discovery, and mean time to respond measures how long it takes to contain and resolve them once detected. Tracked over time and broken down by incident type or severity, these trends show whether investments in tools, training and process changes are improving outcomes, and they are meaningful to senior management because shorter times generally mean less damage. The total number of alerts generated each month reflects tool configuration and threat activity but not response performance, and it can increase or decrease for reasons unrelated to capability. The number of security tools deployed measures spending and activity rather than results; more tools may even slow response if they add complexity. The number of firewall rules reviewed is an operational activity metric for a different process and says nothing about incident handling. Exam caveat: metrics should be defined consistently, so that changes reflect real performance rather than shifting definitions of when detection or response begins. Operational check: confirm metric definitions, data sources and baseline values, and report trends alongside improvement actions.