A security incident handling process is a set of procedures and activities that aim to identify, analyze, contain, eradicate, recover from, and learn from security incidents that affect the confidentiality, integrity, or availability of information assets12.
The maturity of a security incident handling process is the degree to which the process is defined, managed, measured, controlled, and improved, and the extent to which it meets the organization’s objectives and expectations34.
The best key performance indicator (KPI) to measure the maturity of a security incident handling process is the number of recurring security incidents, which is the frequency or rate of security incidents that are repeated or reoccur after being resolved or closed56.
The number of recurring security incidents is the best KPI because it reflects the effectiveness and efficiency of the security incident handling process, and the ability of the process to prevent or reduce the recurrence of security incidents through root cause analysis, corrective actions, and continuous improvement56.
The number of recurring security incidents is also the best KPI because it is directly related to the organization’s objectives and expectations, such as minimizing the impact and cost of security incidents, enhancing the security posture and resilience of the organization, and complying with the relevant standards and regulations56.
The other options are not the best KPIs, but rather possible metrics that may support or complement the measurement of the maturity of the security incident handling process. For example:
The number of security incidents escalated to senior management is a metric that indicates the severity or complexity of security incidents, and the involvement or awareness of the seniormanagement in the security incident handling process56. However, this metric doesnot measure the effectiveness or efficiency of the process, or the ability of the process to prevent or reduce security incidents56.
The number of resolved security incidents is a metric that indicates the output or outcome of the security incident handling process, and the performance or productivity of the security incident handling team56. However, this metric does not measure the quality or sustainability of the resolution, or the ability of the process to prevent or reduce security incidents56.
The number of newly identified security incidents is a metric that indicates the input or demand of the security incident handling process, and the capability or capacity of the security incident detection and identification mechanisms56. However, this metric does not measure the effectiveness or efficiency of the process, or the ability of the process to prevent or reduce security incidents56. References =
1: Computer Security Incident Handling Guide, NIST Special Publication 800-61, Revision 2, August 2012
2: ISO/IEC 27035:2016 Information technology — Security techniques — Information security incident management
3: Capability Maturity Model Integration (CMMI) for Services, Version 1.3, November 2010
4: COBIT 2019 Framework: Introduction and Methodology, ISACA, 2018
5: KPIs for Security Operations & Incident Response, SecurityScorecard Blog, June 7, 2021
6: Key Performance Indicators (KPIs) for Security Operations and Incident Response, DFLabs White Paper, 2018
