Impact Methodology
What is an OT Incident?
"An attack that had a cyber component and had an impact on the ability of an OT system to produce and deliver their product or service."
Who this isn't for
Not for technical deep-dives into novel TTPs or security control analysis. This is a communication tool for those outside the community.
The Calculation
Score = (S × R × D) / 100
Rounded to nearest tenth (0.0 - 10.0)
Impact Thresholds
≤ 1.0
Minimal Impact
1.0 - 2.0
Low Impact
2.0 - 3.0
Moderate Impact
3.0 - 5.0
High Impact
5.0 - 8.0
Severe Impact
8.0 - 10.0
Catastrophic Impact
Scoring Component Details
Severity Scale
1: Disruption in or on OT, but no impact on customer or safety; trivial owner impact.
2: Disruption on OT; no impact on customer or safety; minor owner impact.
3: Delivery of product or service is slightly degraded.
4: Delivery is slightly degraded and the owner has minor cost equipment damage.
5: Delivery of product or service is moderately degraded.
6: Delivery is moderately degraded and there is moderate cost equipment damage.
7: Delivery of product or service is halted or there is a safety hazard.
8: Delivery halted or high cost equipment damage, or a single loss of life.
9: Delivery halted and high cost equipment damage, or multiple person loss of life.
10: Total destruction of operations environment or significant loss of life.
Reach Scale
1: Small community or single site company.
2: Small to medium size city/metro area or medium size company.
3: Large city or metro area or large company.
4: A large country or region, but substitute product or service exists.
5: Global impact, but a substitute product or service exists.
6: A large city / metro area or a small country; no substitute exists.
7: Part of large country, many smaller countries; no substitute exists.
8: A large country or region, no substitute product or service exists.
9: Global affecting specific sector; no substitute product or service exists.
10: Global affecting all people; no substitute product or service exists.
Duration Scale
1: Customer was not impacted.
2: Minor degradation rectified in less than one hour.
3: Minor degradation rectified in less than six hours.
4: Outage for over 1 minute.
5: Outage for over 1 hour.
6: Outage for over 6 hours.
7: Outage for over 1 day.
8: Outage for over 1 week.
9: Outage for over 1 month.
10: Outage for over 6 months and/or loss of life.