Mean time to detection must be under one hour. Mean time to respond, under four.
Full reading
Chapter 21: Deep Cyber Leadership — Seeing in the Digital Dark
Deep cyber leadership goes beyond tools to strategic, diplomatic, and cultural impact. It moves the leader from 'technical manager' to 'cyber statesman' who reads the digital dark and acts before the breach.