How do you calculate firewall rule review time?

Divide the number of rules by your review rate to get base hours, then multiply by one plus the follow-up allowance. With 640 rules at 28 rules/hr you get 22.86 base hours, and a 35% allowance brings the required time to 30.86 hours.

What is a realistic firewall rule review rate?

For OT and industrial firewalls, 20 to 35 rules per hour is typical for a careful first-pass certification; the 28 rules/hr used here sits in the middle. Rates drop sharply when rules use complex object groups or lack documentation.

Why add an owner follow-up allowance?

Most review time isn't spent reading rules, it's spent identifying who owns an unclear rule, confirming whether it's still needed, and processing the change ticket to remove or tighten it. The 35% allowance here captures that overhead.

How often should industrial firewall rules be reviewed?

IEC 62443 and most OT security programs call for at least an annual rule-base recertification, with reviews also triggered after major plant or network changes. Sizing the effort with this calculator helps you fit it into a maintenance window.

Does this include time to actually remove bad rules?

Partly. The follow-up allowance covers raising and tracking change requests, but the actual change-window implementation and testing of removed rules is usually scheduled separately, since OT changes need operations sign-off.

What is a good number of firewall rules?

There's no fixed target, but a rule base that has grown past several hundred entries with many any-any or unused rules signals technical debt. A review like this one, sizing 640 rules, is often the first step toward consolidating that set.

Industrial Cybersecurity & OT Risk calculator

Firewall Rule Review Load Calculator

Firewall rule review load estimates how many analyst hours a manufacturing or OT firewall rule-base audit will actually consume, including the time spent chasing rule owners and pushing change requests. OT and IT security teams use it when scoping the annual rule recertification that frameworks like IEC 62443 and PCI expect, or when a Purdue-model segmentation project leaves a sprawling rule set behind. Industrial firewalls accumulate dead, shadowed, and overly permissive any-any rules over years of plant changes, so a realistic time estimate prevents the review from being booked as a two-hour task and then stalling for weeks. Getting the number right means you can staff the audit, schedule maintenance windows, and set expectations with plant operations before the work starts.

What this calculator does

Estimate labor time for reviewing industrial firewall rules, zone conduits, and approved OT communication paths.
Use it when preparing rule recertification, segmentation audits, or change window planning.
It computes the analyst hours required to review an industrial firewall rule base, including owner follow-up and change-request overhead.

Formula used

Base firewall rule review time = industrial firewall rules to review ÷ firewall rule review rate
Required firewall rule review time = base firewall rule review time × allowance factor

Inputs explained

Industrial firewall rules to review:
Firewall rule review rate:
Owner follow up and change allowance:

How to use the result

Use it when scoping an annual firewall rule recertification or a post-segmentation cleanup, before committing staff or maintenance windows.
It assumes uniform rule complexity and a single average review rate, so rule bases heavy with object groups or undocumented entries will run longer than estimated.

Common questions

How do you calculate firewall rule review time? Divide the number of rules by your review rate to get base hours, then multiply by one plus the follow-up allowance. With 640 rules at 28 rules/hr you get 22.86 base hours, and a 35% allowance brings the required time to 30.86 hours.
What is a realistic firewall rule review rate? For OT and industrial firewalls, 20 to 35 rules per hour is typical for a careful first-pass certification; the 28 rules/hr used here sits in the middle. Rates drop sharply when rules use complex object groups or lack documentation.
Why add an owner follow-up allowance? Most review time isn't spent reading rules, it's spent identifying who owns an unclear rule, confirming whether it's still needed, and processing the change ticket to remove or tighten it. The 35% allowance here captures that overhead.
How often should industrial firewall rules be reviewed? IEC 62443 and most OT security programs call for at least an annual rule-base recertification, with reviews also triggered after major plant or network changes. Sizing the effort with this calculator helps you fit it into a maintenance window.
Does this include time to actually remove bad rules? Partly. The follow-up allowance covers raising and tracking change requests, but the actual change-window implementation and testing of removed rules is usually scheduled separately, since OT changes need operations sign-off.

Last reviewed 2026-05-12.