Industrial Cybersecurity & OT Risk calculator

Mean Time to Contain Cyber Calculator

Use this calculator to estimate containment time for an OT cybersecurity incident response scenario. It stays defensive and focuses on coordination, approved isolation steps, system owner communication, evidence preservation, and safe operations handoff.

What this calculator does

  • Estimate cyber containment workload time using affected systems, containment rate, and coordination allowance.
  • Use it when planning OT incident response, isolation procedures, vendor coordination, and recovery readiness.
  • The result estimates hours needed for approved containment work.

Formula used

  • Base cyber containment time = affected OT systems or containment tasks ÷ containment completion rate
  • Required cyber containment time = base cyber containment time × allowance factor

Inputs explained

  • Affected OT systems or containment tasks: Count systems, zones, accounts, remote sessions, or approved containment work packages in scope.
  • Containment completion rate: Use a tested rate for coordinated containment tasks including approvals, system owner communication, and validation.
  • Coordination and validation allowance: Add time for operations review, safety checks, vendor coordination, documentation, and recovery handoff.

How to use the result

  • Use it to set response targets, rehearse playbooks, and identify staffing or approval bottlenecks.
  • It stays within approved defensive response planning and does not include unauthorized isolation guidance.

Common questions

  • What is the mean time to contain cyber calculator for? It estimates time needed to complete approved OT cyber containment tasks.
  • What information should I enter? Use affected task count, containment completion rate, and coordination allowance.
  • What does the result tell me? The result helps plan incident response staffing and response time objectives.
  • When is the result only an estimate? It is only an estimate when incident scope, approval paths, vendor support, or safety constraints change.

Last reviewed 2026-05-12.