Mean Time to Respond
Definition
Mean Time to Respond
Mean time to respond is the average interval between an incident being detected and the first genuine corrective action being taken against it. It is the handover between knowing and doing, and it is the shortest interval in the incident timeline.
Acknowledgement is not a response. Clicking an alert to silence it proves someone is awake — not that anyone has started working the problem.
Rota design decides the number. Response time is almost entirely a function of who is on call, how they are paged, and whether they can act without waiting for approval.
Key takeaways
- Mean time to respond averages the gap between detection and the first corrective action.
- Acknowledging an alert is not a response and should not stop the clock.
- Overnight and weekend figures reveal rota gaps that daytime averages hide.
- Approval requirements lengthen response more than technical difficulty does.
How it works
Mean time to respond is calculated by summing the intervals between detection and first corrective action across all incidents in a period, then dividing by the number of incidents to give an average.
The formula is: total response intervals ÷ number of incidents.
Four factors set the figure, and only one of them is about engineering ability.
| Factor | Effect on response | Fix |
|---|---|---|
| Paging reliability | Missed pages add hours | Test the escalation chain |
| Rota coverage | Gaps concentrate overnight | Follow-the-sun or on-call pay |
| Approval gates | Waiting for sign-off | Pre-authorise standard actions |
| Runbook quality | Time spent deciding what to do | Document the first five steps |
The approval row is the one most often overlooked. An engineer who knows the fix but needs a manager at 2am is not slow — they are blocked.
Report response by hour of day. A four-minute daytime average paired with a 40-minute overnight one is two very different operations wearing one number.
Security work makes this explicit. The U.S. National Institute of Standards and Technology publishes the Cybersecurity Framework, whose CSF 2.0 release helps organisations understand and reduce cybersecurity risk across their operations.
Practical guidance for public digital services is published openly. Digital.gov shares guidance on building better digital services in government and runs communities of practice on user experience.
The measure is the incident-side cousin of first response time (FRT) in customer support, and the two are often confused in reporting tools.
Ownership is usually shared. A security operations center (SOC) owns threat response while engineering owns availability, and the two rotas rarely match.
Never treat a fast response as a good outcome on its own. Responding in 60 seconds and then taking three days to repair is not a success story.
Examples
Response performance depends far more on rota design and on how much authority the on-call engineer holds than on technical skill. Five cases show where the minutes actually disappear in practice.
Cloud providers respond automatically for known failure modes. Runbooks execute without human involvement, which removes the interval entirely for those cases.
Financial institutions respond to fraud alerts in seconds. Regulatory expectation and pre-authorised blocking actions mean nobody waits for approval.
Hospitals tier response by clinical impact. Systems touching patient care carry minutes while back-office systems carry hours, written into the contract.
Manufacturers respond fastest on the line. Maintenance teams are physically present during production, so the paging step barely exists.
Outsourced operations teams report response by severity and by hour — buyers should ask specifically for overnight and weekend figures, since rota gaps never appear in a daytime average.
Related terms
Mean time to respond sits between detection and repair in the incident timeline. The terms below cover the neighbouring measures, the functions that own the rota, and the contracts that set the targets.
- First Response Time (FRT): the customer-support equivalent measured against tickets.
- Average Response Time: the broader mean across all replies rather than the first action.
- Internal Response Time: the equivalent measure for internal support requests.
- Security Operations Center (SOC): the function owning threat response around the clock.
- Escalation Plan: the document defining who is paged and when.
- Support Ticket: the record most response clocks run against.
- Service Level Agreement (SLA): the contract that tiers response targets by severity.
FAQ
How is mean time to respond calculated?
Sum the intervals between detection and first corrective action across all incidents, then divide by the number of incidents.
Does acknowledging an alert count as responding?
No. Acknowledgement proves someone saw the alert; the clock should stop at the first genuine corrective action.
What lengthens response time most?
Approval requirements and rota gaps, well ahead of technical difficulty.
Why report by hour of day?
Because overnight and weekend gaps are invisible inside a blended daily average.
How does it differ from first response time?
This measure covers incidents and internal action, while first response time covers replying to a customer.
Is a fast response enough on its own?
No, since quick acknowledgement followed by slow repair still leaves the customer without service.
Source partners running around-the-clock incident cover for clients can compare models via Outsource Accelerator hubs.
Independent
