These tables DO NOT include costs for staff, equipment, or services outside of the Information

Technology Department.

Scenario 1 – AS400/data destruction

Resource Description Minimum Hours Cost per unit per hour

Required to Remediate (including margins of 18%)

Technical Hardware; storage 900 94.40

Data Data sets; Databases 600 82.60

Services Network; forensics 400 147.50

Legal Consultation; oversight 400 168.00

Communications PR; internal 400 70.80

Management Incident oversight; 1000 118.00
staff oversight
3rd Party Various 500 88.50

Scenario 2 – Malware/data theft & system disablement

Resource Description Minimum Hours Cost per unit per hour

Required to Remediate (including margins of 18%)
Technical Hardware; storage 1500 94.40

Data Data sets; Databases 900 82.60

Services Network; forensics 1500 147.50

Legal Consultation; oversight 600 168.00

Communications PR; internal 400 70.80

Management Incident oversight; 800 118.00

staff oversight

3rd Party Various 800 88.50

Scenario 3 - Ransomware

Resource Description Minimum Hours Cost per unit per hour

Required to Remediate (including margins of 18%)
Technical Hardware; storage 2400 94.40

Data Data sets; Databases 400 82.60

Services Network; forensics 1600 147.50

Legal Consultation; oversight 400 168.00

Communications 400 70.80

Management Incident oversight; 1600 118.00

staff oversight
3rd Party Various 1200 88.50

Scenario 4 – Tainted product

Resource Description Minimum Hours Cost per unit per hour

Required to Remediate (including margins of 18%)

Technical Hardware; storage 500 94.40

Data Data sets; Databases 500 82.60

Services Network; forensics 1000 147.50

Legal Consultation; oversight 600 168.00

Communications PR; internal 600 70.80

Management Incident oversight; 500 118.00

staff oversight

3rd Party Various 500 88.50

In my estimation I made the following assumptions:

1. A single plant was affected
2. Damage to hardware would be minimal but would need to be tested before returning to
production
3. Damage to data or data sources would be minimal but would need to be tested before
returning to production
4. Significant rise in outside services would be required to support the integrity of the
internal investigation and clean up.
5. Communications requires more efforts since the recipients would consist of internal and
external recipients as well as, vertical communications. Similarly, there would be more
legal involvement and oversight due to increased external communications.
6. Less management oversight would be required. Most of the work would be “routine” and
perfunctory.