Maritime Cyber Incident Recovery, OT Downtime, Business Interruption & Restoration Cost Tool

Maritime Cyber Resilience · Vessel OT · Incident Response · Owner Financial Exposure

Maritime Cyber Incident Recovery, OT Downtime, Business Interruption & Restoration Cost Tool

Prioritize restoration of affected ship systems, estimate impaired vessel earnings, compare repair and response expenses, and separate insurance claims from actual collections. Designed for fleet response planning, not cyber clearance or authorization to sail.

Interactive OT systems mapDependency-aware restoration timelineFleet earning-capacity curveCash / business interruption bridgeInsurance recovery review

Fast response-cost screen · 12 inputsAssumes one affected group with full initial impairment, then a reduced operating state until recovery and validation. All rates and times are user supplied.

Fleet cyber recovery workbenchSet the portfolio assumptions below and edit six detailed registers after the charts. Assign one predecessor per OT system; linked vendor arrivals affect work start. Cost entries are additive, so do not duplicate invoices across registers.

Decision boundary: A financial recovery forecast is not a cyber forensic finding, OT system validation, flag/class/port-state authorization, safe-manning decision, or determination of insurable business interruption. The vessel master and responsible technical/cyber officers retain operational authority. Treat all cyber evidence as potentially sensitive and verify notification obligations separately.

Affected Vessel Systems & Restoration Dependencies

Impact is the modeled percentage of daily earnings impaired on each affected vessel; simultaneous impacts are additive but capped at 100% to avoid unlimited loss. Predecessor indexes are row numbers in this register; only earlier active rows are permitted. Verified restoration requires evidence.

Use	System / OT function	Incident	Category	Vessels	Impact %	Status	Earliest start h	Repair h	Validation h	Predecessor row	Evidence	Remove

Response Contractors, OEM Access & Mobilization

Confirmations are not assumed. Assigned vendor arrival time can delay the linked system's earliest repair start. Fixed and hourly costs are additive to the incident expense ledger.

Use	Response activity	System row	Arrival hour	Service hours	Fixed USD	Hourly USD	Confirmed?	Remove

Response, Notification & Restoration Checkpoints

Deadlines are entered scenarios, not default regulatory limits. Hours are measured from the incident start. Mark a checkpoint complete only with a supporting record.

Use	Checkpoint	Category	Due hour	Completed hour	Status	Remove

Incremental Incident Cost Ledger

Only enter charges not already in the vendor register. Cash expenses are treated separately from opportunity losses and from claim collections.

Use	Incremental expense	Category	Cost USD	Evidence	Remove

Insurance, Indemnity & Cash Recovery Register

The quoted policy limit is not a payment. Written approvals are separate from cash received. These rows record claims and receipts, not automatic coverage; no policy is represented as binding.

Use	Coverage / recovery	Type	Limit USD	Deductible USD	Claimed USD	Approved USD	Received USD	Status	Remove

Safety, Evidence & Readiness Verification

Critical unresolved entries create review holds. References stay local to this webpage and are included only in user-initiated exports, not hidden Tool Data.

Use	Review / release condition	Group	Critical?	Status	Local evidence reference	Remove

By the ShipUniverse Editorial Team — About Us | Contact