Pattern
Measure the time between each response step
The note recommends measuring the time between response steps rather than counting incidents, because intervals can be generated on demand and compared quarter to quarter, which incident counts cannot. Incident counts depend on how hard an organisation looks. Detection, containment, and recovery intervals can be generated on demand and compared over time.
The pattern
Claim: recommendation
Do not wait for incidents to produce metrics. Inject known, safe activity that a control claims to detect, and measure the interval to alert, to accurate understanding, and to containment action. Repeat on a schedule with varied techniques.
The resulting numbers are comparable quarter to quarter, which incident counts are not.