Which of the following metrics is MOST useful to demonstrate the effectiveness of an incident response plan?