How do you estimate labor hours for a cyber drill?

Divide the number of drill work items or participant sessions by your completion rate to get base hours, then multiply by one plus the allowance. With 72 items at 6 items/hr and a 50% allowance, that is 12 base hours scaling to 18 total.

What does the preparation and follow up allowance cover?

It captures the scenario design, inject building, participant briefing, and after-action reporting that surround the live drill time. The 50% allowance in the example reflects a well-documented exercise with a full write-up.

What is a good drill labor load to budget for?

It depends on scope, but expect prep and follow-up to add 40-60% on top of in-session time for a documented exercise. The 18-hour result for 72 items is a reasonable mid-sized tabletop with proper closeout.

Should I count facilitator time or participant time?

Define your work items consistently. If you use participant sessions, the load reflects total participant hours; if you use facilitator work items, it reflects coordination effort. Do not mix the two in one estimate.

How is this different from incident containment time?

Containment time measures responding to a real incident; drill labor load measures the planned effort to rehearse for one. Drills are scheduled and bounded, so the allowance covers prep and reporting rather than live-incident coordination chaos.

Can I lower the labor load?

Yes, by reusing scenario templates to raise the completion rate and by streamlining after-action reporting to shrink the allowance. Reusable inject libraries are the single biggest time saver across a drill program.

Industrial Cybersecurity & OT Risk calculator

Cyber Drill Labor Load Calculator

Cyber Drill Labor Load estimates the total person-hours needed to plan, run, and close out an OT incident-response exercise, from tabletops to full red-team drills. OT security managers and exercise coordinators use it to budget staff time, justify a drill schedule, and avoid pulling control-room operators off-shift without accounting for the real cost. A drill is more than the time in the room: injects must be built, participants briefed, and findings written up. Sizing the labor load up front keeps your exercise program realistic and defensible at budget time.

What this calculator does

Estimate labor hours required for an OT cyber drill or tabletop exercise using participant work items, completion rate, and allowance.
Use it when planning incident response drills, backup recovery exercises, or plant cyber tabletop events.
It computes the total labor hours for a cyber drill by dividing work items or sessions by the completion rate, then adding a preparation-and-follow-up allowance.

Formula used

Base cyber drill labor time = cyber drill work items or participant sessions ÷ drill completion rate
Required cyber drill labor time = base cyber drill labor time × allowance factor

Inputs explained

Cyber drill work items or participant sessions:
Drill completion rate:
Preparation and follow up allowance:

How to use the result

Use it when scheduling an exercise, requesting staff time, or comparing the cost of tabletop versus live drills.
It assumes a steady completion rate; complex multi-team injects or scenarios with live system interaction can run slower, so validate the rate against your actual exercise history.

Common questions

How do you estimate labor hours for a cyber drill? Divide the number of drill work items or participant sessions by your completion rate to get base hours, then multiply by one plus the allowance. With 72 items at 6 items/hr and a 50% allowance, that is 12 base hours scaling to 18 total.
What does the preparation and follow up allowance cover? It captures the scenario design, inject building, participant briefing, and after-action reporting that surround the live drill time. The 50% allowance in the example reflects a well-documented exercise with a full write-up.
What is a good drill labor load to budget for? It depends on scope, but expect prep and follow-up to add 40-60% on top of in-session time for a documented exercise. The 18-hour result for 72 items is a reasonable mid-sized tabletop with proper closeout.
Should I count facilitator time or participant time? Define your work items consistently. If you use participant sessions, the load reflects total participant hours; if you use facilitator work items, it reflects coordination effort. Do not mix the two in one estimate.
How is this different from incident containment time? Containment time measures responding to a real incident; drill labor load measures the planned effort to rehearse for one. Drills are scheduled and bounded, so the allowance covers prep and reporting rather than live-incident coordination chaos.

Last reviewed 2026-05-12.