In cybersecurity governance, which metric reflects the speed of detecting and resolving security issues?

• A. Time to deploy a security patch to production only.
• B. Time between revenue recognition events.
• C. Time to decommission a system.
• D. Time to detect and resolve a security issue.

Answer: (D)

Measuring how quickly security issues are found and handled captures how responsive the security program is. This metric directly reflects incident detection and remediation speed, showing how fast problems are identified and then contained and fixed. In governance terms, faster detection and resolution means less time that vulnerabilities are exposed and potentially exploited, reducing overall risk. It’s common to look at components like mean time to detect and mean time to resolve, which together describe the full incident lifecycle from discovery to closure. The other options don’t measure this end-to-end responsiveness: patching a system to production only tracks deployment speed, not detection or remediation; a metric tied to revenue timing isn’t about security incidents; and decommissioning a system relates to asset retirement rather than how quickly security issues are found and fixed. So the metric for the speed of detecting and resolving security issues is the time to detect and resolve a security issue.