How the score works
Industrial security experts answer three questions about each incident: how bad it was, how far it reached and how long it lasted. Each answer is a rating from 1 to 10. The three ratings combine into one number from 0 to 10.
What counts as an OT incident
An attack that had a cyber component and had an impact on the ability of an OT system to produce and deliver their product or service.
OT stands for operational technology: the computers that run pumps, valves, power lines and assembly lines.
Who the score is for
The score is a communication tool for people outside the industrial security community: reporters, elected officials, executives and the public.
It is not a technical analysis of how an attack worked or which security controls failed.
The three questions
Each expert rates every incident on all three questions. Each rating has a plain-language meaning and the official wording the experts score against.
How bad was it? (Severity)
How much harm to operations, customers or safety
- 1Some trouble with equipment, but customers and safety were not affected.Official wording: Disruption in or on OT, but no impact on customer or safety; trivial owner impact.
- 2Equipment trouble that cost the owner a little, with no effect on customers or safety.Official wording: Disruption on OT; no impact on customer or safety; minor owner impact.
- 3Products or services were slightly slowed.Official wording: Delivery of product or service is slightly degraded.
- 4Products or services were slightly slowed, with minor equipment damage.Official wording: Delivery is slightly degraded and the owner has minor cost equipment damage.
- 5Products or services were noticeably slowed.Official wording: Delivery of product or service is moderately degraded.
- 6Products or services were noticeably slowed, with some costly equipment damage.Official wording: Delivery is moderately degraded and there is moderate cost equipment damage.
- 7Products or services stopped, or there was a safety hazard.Official wording: Delivery of product or service is halted or there is a safety hazard.
- 8Products or services stopped, or there was major equipment damage or one death.Official wording: Delivery halted or high cost equipment damage, or a single loss of life.
- 9Products or services stopped with major equipment damage, or several people died.Official wording: Delivery halted and high cost equipment damage, or multiple person loss of life.
- 10Operations were destroyed, or many people died.Official wording: Total destruction of operations environment or significant loss of life.
How far did it reach? (Reach)
How many people, places or markets were affected
- 1One small community or one site.Official wording: Small community or single site company.
- 2A small or medium city, or a medium-sized company.Official wording: Small to medium size city/metro area or medium size company.
- 3A large city or a large company.Official wording: Large city or metro area or large company.
- 4A large country or region, but people could get what they needed elsewhere.Official wording: A large country or region, but substitute product or service exists.
- 5Worldwide, but people could get what they needed elsewhere.Official wording: Global impact, but a substitute product or service exists.
- 6A large city or small country, with no other option for people.Official wording: A large city / metro area or a small country; no substitute exists.
- 7Part of a large country or several small countries, with no other option.Official wording: Part of large country, many smaller countries; no substitute exists.
- 8A large country or region, with no other option.Official wording: A large country or region, no substitute product or service exists.
- 9Worldwide across one industry, with no other option.Official wording: Global affecting specific sector; no substitute product or service exists.
- 10Worldwide, affecting everyone, with no other option.Official wording: Global affecting all people; no substitute product or service exists.
How long did it last? (Duration)
How long the impact lasted
- 1Customers were not affected.Official wording: Customer was not impacted.
- 2Minor trouble, fixed in under an hour.Official wording: Minor degradation rectified in less than one hour.
- 3Minor trouble, fixed in under six hours.Official wording: Minor degradation rectified in less than six hours.
- 4An outage of more than a minute.Official wording: Outage for over 1 minute.
- 5An outage of more than an hour.Official wording: Outage for over 1 hour.
- 6An outage of more than six hours.Official wording: Outage for over 6 hours.
- 7An outage of more than a day.Official wording: Outage for over 1 day.
- 8An outage of more than a week.Official wording: Outage for over 1 week.
- 9An outage of more than a month.Official wording: Outage for over 1 month.
- 10An outage of more than six months, or loss of life.Official wording: Outage for over 6 months and/or loss of life.
The calculation
(S × R × D) ÷ 100
Severity times reach times duration, divided by 100. The result runs from 0.0 to 10.0 and is rounded to the nearest tenth.
The site averages every expert's rating for each question, then multiplies the three averages. Every new rating updates the score.
Because the three ratings are multiplied, a high score needs all three to be high. A severe attack that stayed in one place and was fixed within hours still scores low.
Example: an attack rated 6 for severity, 5 for reach and 7 for duration scores (6 × 5 × 7) ÷ 100 = 2.1, which is Moderate
The six levels
Every score falls into one of six levels. The level follows the score as shown on the site, so 1.0 is Minimal and 1.1 is Low.
Little or no effect on the public. The trouble stayed mostly inside the place that was attacked.
Real trouble for the place that was attacked and the people who rely on it.
Serious trouble for the place that was attacked, or effects felt across a city or region.
Major trouble felt widely, across a region or a whole industry.
Outages lasting days or longer over a wide area, with heavy damage or danger to people.
Operations destroyed, or many lives lost.
See where every rated incident landed on the scale.