OT cybersecurity protects the ability to operate safely and deliver a physical service. An investment case should connect a credible disruption scenario to its consequences, explain how a control changes that scenario, and compare the expected reduction in loss with the full cost of implementing and operating the control. Downtime, spoiled inventory, recovery effort, and service interruption make the discussion concrete. Safety and mandatory obligations remain decision criteria even when a financial return is uncertain.
That is the executive summary. The important next question is: which assumptions make the numbers credible?
The examples below are deliberately fictional teaching calculations, not industry benchmarks, site estimates, or a promise of savings. The arithmetic is a simple decision model, not a formula prescribed by NIST or ISA. Open the investment worksheet in your browser to enter assumptions and calculate estimates—no special software needed. You can save a filled-in editable copy or print/save as PDF. Nothing you enter is sent anywhere or saved automatically. A plain-text Markdown version remains available as an alternative.
Start with a scenario, not a product
“Buy segmentation” describes a solution. “Reduce the chance that a compromised support connection interrupts packaging and refrigeration” describes a business concern. Map the affected process, plausible initiating event, dependencies, existing safeguards, and recovery sequence before choosing the investment.
Different controls affect different parts of the scenario. Restricted access may reduce event frequency; tested recovery artifacts may shorten an outage; independent monitoring may reduce the quantity of product exposed. Do not assume that each improvement eliminates the entire loss, or that a cyber control prevents every mechanical or utility failure.
Calculate expected loss, then compare like-for-like costs
For one scenario, a simple annual model is:
Loss per event = net downtime loss + non-overlapping product loss
+ recovery, testing, and other incremental costs
Expected annual loss = expected events per year × average loss per event
Annual expected benefit = baseline annual loss − residual annual loss
Period ROI = (expected benefit over the period − total period cost)
÷ total period cost × 100%
Expected events per year is a frequency, not necessarily the probability of at least one event. Expected loss is a planning average, not a prediction that this amount will be spent each year. Losses can be rare, clustered, and much larger than their average.
Worked example: an unplanned production interruption
Assume the following estimates have been agreed with operations and finance:
| Input | Before investment | After investment |
|---|---|---|
| Expected relevant incidents per year | 0.20 | 0.10 |
| Operational outage per incident, including restart and acceptance | 8 hours | 5 hours |
| Net contribution lost per unrecoverable production hour | $25,000 | $25,000 |
| Other recovery and qualification cost per incident | $40,000 | $25,000 |
| Loss per incident | 8 × $25,000 + $40,000 = $240,000 | 5 × $25,000 + $25,000 = $150,000 |
| Expected annual loss | 0.20 × $240,000 = $48,000 | 0.10 × $150,000 = $15,000 |
The modeled annual benefit is $33,000. Expected outage exposure falls from 1.6 to 0.5 hours per year—an average, not a guarantee about any individual outage.
Suppose implementation costs $48,000 and ongoing support, training, testing, and maintenance cost $12,000 per year:
- First-year ROI: ($33,000 − $60,000) ÷ $60,000 = −45%.
- Three-year cost: $48,000 + 3 × $12,000 = $84,000.
- Three-year expected benefit: 3 × $33,000 = $99,000.
- Three-year ROI: ($99,000 − $84,000) ÷ $84,000 = 17.9%.
- Simple expected payback: $48,000 ÷ ($33,000 − $12,000) = about 2.3 years.
These undiscounted figures assume immediate, sustained benefits and no additional refresh costs. They are not realized cash returns. A staged rollout, depreciation, taxes, discount rate, or delayed effectiveness needs a finance-approved model; a longer-lived investment may warrant discounted cash flows and net present value. If annual expected benefit does not exceed recurring cost, this simple payback calculation has no positive finite result. If total cost is zero, percentage ROI is undefined.
Use net contribution or another finance-approved measure of genuinely lost production—not gross sales automatically multiplied by outage hours. Account for catch-up capacity, avoided variable costs, inventory buffers, contractual penalties, and whether production would otherwise have occurred. Avoid counting the same product loss again as both lost sales and spoilage.
Product loss: refrigeration and spoilage
Consider a separate cold-storage scenario with 50,000 kg of exposed inventory at $2/kg replacement cost. Assume the expected discarded fraction per incident falls from 40% to 10%, with event frequency unchanged at 0.20 per year:
Baseline product loss = 50,000 × $2 × 40% = $40,000 per event
Residual product loss = 50,000 × $2 × 10% = $10,000 per event
Annual expected benefit = 0.20 × ($40,000 − $10,000) = $6,000
This might support a case for better detection, isolation, or recovery, but only if the proposed measures plausibly change the exposure. Food-safety or quality personnel determine product acceptability; a model does not authorize releasing inventory after a temperature excursion. Disposal, replacement, and lost margin need consistent accounting. Do not add this $6,000 to the production example unless they represent distinct, non-overlapping losses in an explicitly combined scenario model.
Safety: quantify the scenario without pricing away the obligation
Safety benefits can be expressed as reduced hazardous-event frequency, fewer exposed people or operating hours, or improved detection and safe-state response. They should be evaluated with the appropriate process-safety specialists, not inferred from a cybersecurity maturity score.
For illustration only, suppose an initiating event occurs at 0.02 events/year and its conditional probability of escalating to a defined hazardous outcome is 0.10. If a validated mitigation reduced that conditional probability to 0.02, the arithmetic would be:
Baseline hazardous-outcome frequency = 0.02 × 0.10 = 0.002 per year
Residual hazardous-outcome frequency = 0.02 × 0.02 = 0.0004 per year
Relative reduction = (0.002 − 0.0004) ÷ 0.002 = 80%
Those invented inputs do not establish real risk reduction or acceptable residual risk. This is not a hazard analysis, a safety-integrity-level assessment, or justification for crediting an independent protection layer. Independence, common-cause failures, cyber compromise of safeguards, proof testing, and the actual operating conditions can invalidate a simple multiplication.
Keep safety outcomes alongside the financial model rather than inventing a dollar value for a life to make ROI positive. Applicable safety duties, risk-tolerability criteria, and legal obligations are constraints—not optional purchases justified only by expected financial savings. Financially attractive options still need engineering and operational acceptance.
Show uncertainty and measure what changes
The production example's three-year cost remains $84,000. Changing only the assumed annual benefit produces very different answers:
| Sensitivity case—not a confidence interval | Annual expected benefit | Three-year ROI |
|---|---|---|
| Lower benefit | $10,000 | −64.3% |
| Central teaching assumption | $33,000 | 17.9% |
| Higher benefit | $60,000 | 114.3% |
Document where frequency and consequence estimates came from, what evidence supports control effectiveness, and which assumptions dominate the decision. Report separately the ordinary maintenance costs or planned interruption introduced by the security change. Related scenarios may share a cause or loss; do not sum overlapping benefits or claim each control's standalone benefit again for the combined program.
After implementation, track measurable evidence: tested recovery duration through operational acceptance, successful restoration of engineering artifacts, unauthorized access paths removed, incident containment performance, and product-exposure time. These can support or challenge the assumptions; an incident-free year alone does not prove the investment prevented an incident.
The strongest executive case states the service at risk, the change being proposed, the expected benefit range, the full lifecycle cost, the remaining risk, and the owner accountable for verification. That connects an architecture decision to a business decision without claiming certainty the evidence cannot support.
Further reading
- NIST SP 800-82 Rev. 3: OT security in the context of performance, reliability, safety, and physical consequences.
- NIST SP 800-30 Rev. 1: risk assessment, likelihood, impact, assumptions, and uncertainty.
- ISA: Building a business case for operational technology cybersecurity: connecting security work to a sustained investment case.
- ISA/IEC 62443 series: lifecycle responsibilities and risk-based system requirements. See also the governance and compliance overview.
For a hands-on illustration of the difference between restoring equipment and restoring service, try the recovery explorer or the cooling dependency explorer. Their simulated times and consequences are not estimates for this investment model or a real facility.