How do you calculate Mean Time to Contain for an OT incident?

Divide the number of affected OT systems or containment tasks by your containment completion rate to get base time, then multiply by one plus the allowance fraction. With 28 tasks at 3.5 tasks/hr you get 8 hours of base time, and a 45% allowance brings it to 11.6 hours.

What is the difference between MTTC and MTTD?

Mean Time to Detect (MTTD) is how long it takes to notice the incident; Mean Time to Contain (MTTC) starts once you are aware and ends when lateral spread is stopped. In OT, MTTC is often the more painful number because isolating live controllers is slow and safety-gated.

What is a good Mean Time to Contain for industrial systems?

There is no universal benchmark, but mature OT programs aim to contain within a shift (8-12 hours) for a contained subnet incident. The 11.6-hour result here sits at the upper edge of one shift, which is workable but signals you should pre-stage isolation steps.

Why is the coordination and validation allowance so important?

In a plant, you cannot just pull cables; every isolation step needs operator sign-off, safety confirmation, and verification that production is stable. The 45% allowance in the example captures that overhead, turning 8 base hours into 11.6 realistic hours.

How can we reduce our containment time?

Raise the containment completion rate with pre-built network ACLs, one-click VLAN isolation, and tested runbooks, and shrink the allowance by rehearsing coordination during drills. Cutting the rate-driven base time has the biggest leverage.

Does this MTTC include eradication and recovery?

No. This metric stops at containment. Eradication (removing the threat) and recovery (restoring systems from validated backups) are separate phases you should model with backup-restore and recovery calculators.

Industrial Cybersecurity & OT Risk calculator

Mean Time to Contain Cyber Calculator

Mean Time to Contain (MTTC) measures how long an OT/ICS security team takes to isolate and halt the spread of an active cyber incident across affected control systems. It is one of the core incident-response KPIs that OT security managers, SOC leads, and plant cyber engineers track against their incident-response plan and IEC 62443 obligations. Unlike IT environments, containment on a plant floor means quarantining PLCs, HMIs, and engineering workstations without tripping safety systems or unplanned production stops. A realistic MTTC tells you whether your runbooks, segmentation, and on-call coverage can actually stop lateral movement before it reaches a Level 1 controller.

What this calculator does

Estimate cyber containment workload time using affected systems, containment rate, and coordination allowance.
Use it when planning OT incident response, isolation procedures, vendor coordination, and recovery readiness.
It computes the required containment time in hours by dividing affected OT systems or tasks by your containment completion rate, then padding the result with a coordination-and-validation allowance.

Formula used

Base cyber containment time = affected OT systems or containment tasks ÷ containment completion rate
Required cyber containment time = base cyber containment time × allowance factor

Inputs explained

Affected OT systems or containment tasks:
Containment completion rate:
Coordination and validation allowance:

How to use the result

Use it when scoping incident-response capacity, dry-running a tabletop, or stress-testing whether your team can meet a contractual or regulatory containment-time target.
It assumes a steady containment rate; a fast-spreading worm or a controller that must be safely transitioned to manual can blow past the modeled time, so treat the output as a planning baseline, not a guarantee.

Common questions

How do you calculate Mean Time to Contain for an OT incident? Divide the number of affected OT systems or containment tasks by your containment completion rate to get base time, then multiply by one plus the allowance fraction. With 28 tasks at 3.5 tasks/hr you get 8 hours of base time, and a 45% allowance brings it to 11.6 hours.
What is the difference between MTTC and MTTD? Mean Time to Detect (MTTD) is how long it takes to notice the incident; Mean Time to Contain (MTTC) starts once you are aware and ends when lateral spread is stopped. In OT, MTTC is often the more painful number because isolating live controllers is slow and safety-gated.
What is a good Mean Time to Contain for industrial systems? There is no universal benchmark, but mature OT programs aim to contain within a shift (8-12 hours) for a contained subnet incident. The 11.6-hour result here sits at the upper edge of one shift, which is workable but signals you should pre-stage isolation steps.
Why is the coordination and validation allowance so important? In a plant, you cannot just pull cables; every isolation step needs operator sign-off, safety confirmation, and verification that production is stable. The 45% allowance in the example captures that overhead, turning 8 base hours into 11.6 realistic hours.
How can we reduce our containment time? Raise the containment completion rate with pre-built network ACLs, one-click VLAN isolation, and tested runbooks, and shrink the allowance by rehearsing coordination during drills. Cutting the rate-driven base time has the biggest leverage.

Last reviewed 2026-05-12.