# OT cybersecurity investment worksheet

Version 1.0 · October 2026 · Dan Fisher / danfisher.dev

Educational planning prompts, not financial, legal, operational, or safety advice.
Worked examples: /writing/the-business-case-for-ot-cybersecurity
License: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/

## 1. Define the decision

- Physical service and accountable owner:
- Specific loss scenario, affected assets, and existing safeguards:
- Proposed change and alternative options:
- Which part changes: event frequency, consequence, or both?
- Implementation constraints, maintenance window, and operational acceptance:
- Safety, regulatory, and contractual requirements that must be met regardless of ROI:

## 2. Record baseline and residual assumptions

For each input, record a baseline value, residual value, plausible range, units,
evidence/source, confidence, and owner. Do not use blank or unknown inputs as zero.

| Input | Baseline | Residual | Range / evidence / owner |
| --- | --- | --- | --- |
| Expected relevant events per year | | | |
| Outage hours per event, through operational acceptance | | | |
| Net financial loss per unrecoverable production hour | | | |
| Exposed inventory quantity per event | | | |
| Inventory replacement cost per unit | | | |
| Expected discarded fraction per event | | | |
| Other incremental recovery/testing/qualification cost per event | | | |

Use relevant cyber scenarios; do not attribute all-cause downtime reduction to
cybersecurity automatically. Separate inventory replacement cost, lost margin,
and outage loss so they do not count the same consequence twice. Document catch-up
production and buffers. QA/food-safety personnel decide product acceptability.

## 3. Calculate on a consistent horizon

For each distinct scenario:

- Downtime loss/event = outage hours × net loss/hour.
- Product loss/event = exposed quantity × replacement cost/unit × discarded fraction.
- Total loss/event = non-overlapping downtime, product, and other incremental costs.
- Expected annual loss = expected events/year × average loss/event.
- Annual expected benefit = baseline expected annual loss − residual expected annual loss.

For the chosen investment period:

- Period benefit = sum of annual expected benefits after implementation/ramp-up.
- Period cost = implementation + sum of recurring costs + other lifecycle costs.
- Period ROI (%) = (period benefit − period cost) / period cost × 100.
- If cost is zero, ROI is undefined; report the absolute difference instead.
- If period benefit is below cost, report negative ROI rather than suppressing it.
- Simple expected payback = implementation cost / (annual expected benefit − recurring annual cost),
  only for stable annual benefits/costs and a positive denominator. Otherwise there
  is no positive finite payback in this simplified model.

Costs to consider: design, equipment/licenses, integration, testing, qualification,
training, documentation, planned interruption, staffing, certificate/key operations,
support, refresh, and retirement. Avoid duplicate cost categories. Agree with finance
whether a discounted cash-flow/NPV model is needed; these formulas are undiscounted.

## 4. Keep safety explicit and separate

- Defined hazardous outcome and exposure:
- Applicable hazard assessment and responsible process-safety specialist:
- Baseline/residual risk estimates, uncertainty, and supporting evidence:
- Assumptions about independence, common-cause failure, safeguard integrity, and testing:
- Required risk-tolerability criteria and evidence for meeting them:
- How the change could introduce new operational or safety risks:

Illustrative arithmetic: hazardous-outcome frequency = initiating-event frequency ×
conditional escalation probability. Do not substitute an ordinal risk score for a
probability. This arithmetic does not establish protection-layer credit, a safety
integrity level, or acceptable residual risk. Do not monetize harm simply to make
ROI positive or use a positive ROI to waive safety requirements.

## 5. Test the uncertainty and verify outcomes

- Lower, central, and higher benefit assumptions (not confidence intervals):
- Sensitivity to event frequency, recovery duration, and control effectiveness:
- Correlated or overlapping scenarios excluded from double counting:
- Evidence needed before implementation approval:
- Post-implementation tests, measures, owners, and review dates:
- Residual risks accepted by whom, under which authority, and for how long:

Expected loss reduction is not guaranteed cash savings. An incident-free year is
not evidence by itself that a control prevented an incident.