Dan Fisher / danfisher.dev · OT learning resources

OT cybersecurity investment worksheet

Connect a specific operational loss scenario to the cost and expected benefit of a proposed change.

Fill in the fields in your browser. Calculations update below. Nothing you enter is sent anywhere or saved automatically. Use Save editable copy to download a filled-in HTML file you can reopen and edit, or Print / Save as PDF for a review copy. Closing or refreshing can discard unsaved work.

All financial amounts are in USD. This is an educational, undiscounted model—not financial, legal, operational, or safety advice. Do not put passwords, private access details, or sensitive site information into copies you intend to share.

1. Describe the decision

2. Enter baseline and residual assumptions

Enter every numeric field, including 0 where a loss category does not apply. Blank is unknown, not zero. Use average consequences for the defined scenario—not all-cause downtime. Product loss and downtime loss must not count the same consequence twice.

Before the investment
After the investment

3. Include the investment’s lifecycle cost

Include design, integration, planned interruption, qualification, training, support, staffing, and refresh where relevant. This model assumes immediate, constant annual benefits and costs; document ramp-up, discounting, or additional costs separately with finance.

Calculated estimates

Complete all numeric fields to calculate. No estimates are shown for incomplete inputs.

Baseline expected annual loss
—
Residual expected annual loss
—
Annual expected loss reduction
—
Total cost over selected period
—
Expected net benefit over selected period
—
ROI over selected period
—
First-year ROI
—
Simple expected payback
—

Expected loss reduction is not guaranteed cash savings. Negative ROI is shown rather than hidden. Zero total cost makes percentage ROI undefined. Payback requires annual benefit to exceed recurring cost; it is not a promised recovery date.

How these estimates are calculated

Loss per event = hours × net hourly loss + inventory × unit replacement cost × discarded percentage / 100 + other incremental costs. Expected annual loss = event frequency × loss per event.

Annual benefit = baseline annual loss − residual annual loss. Period cost = implementation + years × recurring cost. Period ROI = (years × annual benefit − period cost) / period cost × 100%. First-year ROI uses one year’s benefit and costs. Simple payback = implementation / (annual benefit − recurring cost), only when that denominator is positive.

4. Keep safety and mandatory obligations separate

Financial ROI does not establish acceptable safety risk or waive a legal obligation. Do not invent a monetary value for harm to make the result positive. Use qualified process-safety specialists and the applicable hazard-assessment methods.