What Does an Hour of IT Downtime Cost? Survey Figures and What Regulators in Hong Kong, Singapore and the US Already Allow

Key findings: In ITIC's 2024 survey of more than 1,000 firms worldwide, over 90% of mid-size and large enterprises said one hour of downtime costs them more than US$300,000, and 41% put it at US$1 million to over US$5 million. These are respondents' own estimates, and they exclude litigation, fines and penalties. Uptime Institute's 2026 outage analysis reports that 57% of respondents to its 2025 survey said their most recent major outage cost more than US$100,000. No published survey gives a reliable hourly figure for a 30 to 300 person firm in Hong Kong or Singapore. What regulators do publish is a limit: Singapore's MAS caps unscheduled downtime of each critical system at 4 hours in any 12 months, the HKMA makes banks set their own tolerance for disruption, and US rules set no single hours number.

This report answers two questions a finance director, a compliance officer or a head of IT is usually asked together: what does an hour of IT downtime cost, and how much downtime is acceptable? The first question is answered online with one per-minute figure repeated without its source. The second is answered by regulators, but only for the firms they supervise, and almost nobody puts the two side by side.

It is written for firms of roughly 30 to 300 staff in Hong Kong first, then Singapore and the United States: an asset manager, a fintech going through a bank's vendor review, a law firm, a regional office of an overseas group. Every figure below names its source and year. Where a figure is a survey of what respondents believe, it says so. Where no figure exists, it says that too.

Why does one per-minute downtime figure mislead?

Search for the cost of downtime and the same per-minute number appears on page after page. It is more than ten years old, it was never published with a sample or a method, and it is an average across very large companies. For a 60-person office in Hong Kong it is not a low estimate or a high estimate. It is simply not about that office.

Three things make a single figure unreliable:

• The range is enormous. The cost of an hour depends on how much revenue moves through the affected systems in that hour, how many staff stop working, and whether a contract or a regulator attaches a penalty. Those three inputs differ by orders of magnitude between a trading desk and a design studio.
• Most figures are estimates, not losses. The large surveys ask respondents what they believe an hour costs. That is useful for understanding how firms think about risk, but it is not an audited loss.
• The figures leave things out. The most cited survey explicitly excludes litigation, fines and civil or criminal penalties. For a regulated firm, those can be the largest items.

So the honest answer has two halves: what firms report, with its caveats, and what regulators already require, which is often the number that matters more to a regulated buyer.

What do firms report an hour of downtime costs?

ITIC 2024 Hourly Cost of Downtime survey

Information Technology Intelligence Consulting (ITIC) runs an independent web survey on downtime cost. Its 2024 edition polled more than 1,000 firms worldwide between November 2023 and mid-March 2024. Its headline findings:

• Over 90% of mid-size and large enterprises said the average cost of a single hour of downtime now exceeds US$300,000.
• 41% said an hour of downtime costs their firm US$1 million to over US$5 million.
• The figures are exclusive of litigation, civil or criminal penalties, which ITIC states alongside the results.

Two cautions belong with these numbers. First, they are what respondents estimate, not measured losses. Second, the sample leans towards larger organisations, so the headline describes enterprises more than small and mid-size firms. We looked for ITIC's breakdown for the smallest firms and found it quoted inconsistently across secondary sources, so we do not repeat it here.

Uptime Institute Annual Outage Analysis 2026

Uptime Institute publishes an annual analysis of IT and data centre outages. The 2026 edition, announced on 13 May 2026, reports:

• 57% of respondents to Uptime's 2025 annual survey said their most recent major outage cost more than US$100,000.
• Around one in ten said their last outage had serious or severe impacts.
• Over the nine years Uptime has tracked publicly reported outages, third-party IT and data centre service providers, including cloud, internet, telecommunications and colocation companies, accounted for about two-thirds of them.

Uptime's respondents are mostly data centre and IT infrastructure operators, and the full report is available only to its members and subscribers. We cite the figures from the public announcement.

The third finding matters for smaller firms more than the cost figures do. A 50-person company in Hong Kong rarely runs its own data centre. When its systems go down, the cause is very often a provider: a cloud platform, an internet line, a SaaS application, a managed service. The cost lands on the company; the failure sits in someone else's contract.

Singapore: how much downtime does MAS allow?

Singapore is the one market in this report where the regulator writes a downtime number into binding rules.

The Monetary Authority of Singapore issues a Notice on Technology Risk Management for each type of licensed financial institution, under the Financial Services and Markets Act 2022. The current notices were issued in May 2024 and replaced the 2013 notices, including Notice 644 for banks, which was cancelled with effect from 10 May 2024. The bank notice is now FSM-N05; licensed insurers fall under FSM-N03, and other licence types have their own numbers.

The notice for licensed insurers, FSM-N03, sets out the requirements most quoted in this context:

• Unscheduled downtime: the maximum unscheduled downtime for each critical system that affects operations or service to customers must not exceed a total of 4 hours within any period of 12 months.
• Recovery time objective: the institution must establish a recovery time objective (RTO) of not more than 4 hours for each critical system, and validate and document it at least once every 12 months.
• Notification and follow-up: a relevant incident must be notified to MAS within 1 hour of discovery, followed by a root-cause and impact report within 14 days. The reporting clock is covered in detail in our companion report on cyber-incident reporting windows in Hong Kong, Singapore and the US.

The wording is not new. The cancelled bank Notice 644 carried the same 4-hour cap over any 12 months.

Is the MAS rule changing?

MAS published a consultation paper on proposed amendments to the technology risk management notices on 10 June 2026, which closed on 31 July 2026. The main proposal on availability is to make explicit that partial or intermittent disruption counts towards unscheduled downtime of a critical system, because MAS observed that some institutions had left it out of the calculation. As of early November 2026 we found no published final notice or response to feedback. If the change is adopted, a system that runs slowly for an afternoon could count against the 4 hours in a way it may not have been counted before.

What does 4 hours a year mean in practice?

As arithmetic, not as a regulatory statement: a critical system that runs around the clock has 8,760 hours in a year. Four hours of unscheduled downtime is about 0.046% of that, which is the same as roughly 99.95% availability, before any planned maintenance. That is stricter than the 99.9% figure many service contracts quote.

Hong Kong: how much downtime does the HKMA allow?

The Hong Kong Monetary Authority takes the opposite approach to MAS. It does not write a number down. It requires each authorised institution to choose its own.

The HKMA's Supervisory Policy Manual module OR-2 Operational Resilience was issued on 31 May 2022. It gave authorised institutions one year to develop an operational resilience framework and three years after that to implement it. Under OR-2, an institution identifies its critical operations and sets a tolerance for disruption for each: the maximum level of disruption to a critical operation it can accept. Its board approves those tolerances, and it tests whether it can stay within them through mapping and scenario testing.

In a letter dated 29 May 2026, the HKMA reported that, based on its survey, all authorised institutions had reached operational resilience by the end of May 2026 as planned, having identified their critical operations and tolerances for disruption. The HKMA also said institutions should continue to work on reducing those tolerances over time.

What can a company that is not a bank take from OR-2?

OR-2 binds banks and other authorised institutions. Most firms of 30 to 300 staff in Hong Kong are not authorised institutions. Many of them are, however, suppliers to one, or are reviewed by one: a fintech whose bank partner runs a vendor review, a fund administrator, a professional services firm that holds a bank's data.

For those firms the useful part of OR-2 is the method, not the rule:

• Name your critical operations. Not systems, but what the business must keep doing: taking client orders, paying staff, answering a regulator.
• Set a tolerance for each. How long, and how badly, each can be disrupted before the damage is no longer recoverable.
• Map what each depends on. Including every provider in the chain.
• Test against the tolerance. A scenario test that shows you can stay inside it is worth more than a document that says you can.

We found no Hong Kong regulator that publishes a fixed downtime limit for firms outside banking, and no published survey of what an hour of downtime costs a Hong Kong firm of this size. We say that plainly rather than borrow a figure from elsewhere.

United States: is there a single downtime rule?

No. There is no US equivalent of the MAS 4-hour cap that applies across firms.

• Banks and their examiners work from the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook. Its Business Continuity Management booklet, updated in November 2019, expects management to set recovery time objectives through a business impact analysis and to re-evaluate them, rather than prescribing a number of hours.
• Notification rules set clocks, not tolerances. US banking regulators' computer-security incident notification rule and the SEC's disclosure rule for listed companies set deadlines for reporting an incident. They do not define acceptable downtime. Both are covered in our incident-reporting windows report.

In practice, acceptable downtime in the US is set by contract: by the service-level agreements between a firm and its providers, and by what the firm's own customers demand of it.

What do 99.9% and 99.99% uptime actually allow?

Uptime percentages are the most common way a provider expresses a downtime limit, and the easiest to misread. The arithmetic for a service measured around the clock, over a full year:

• 99% uptime allows about 87.6 hours of downtime a year, or roughly 7.3 hours a month.
• 99.9% uptime allows about 8.8 hours a year, or roughly 44 minutes a month.
• 99.95% uptime allows about 4.4 hours a year, close to the MAS 4-hour cap.
• 99.99% uptime allows about 53 minutes a year, or roughly 4.4 minutes a month.

This is arithmetic, not a statement about any provider. Before relying on a percentage, read three things in the contract: whether it is measured monthly or yearly, whether planned maintenance is excluded, and what counts as "down". A system that answers but is too slow to use may not count as down under the contract, which is exactly the gap MAS is now proposing to close for the firms it regulates.

How do you estimate what an hour of downtime costs your own firm?

Because no published survey fits a firm of 30 to 300 staff, the useful number is your own. The method below is a method, not a statistic. It uses your figures, and it should be done for each critical operation rather than for the company as a whole.

The four inputs

• Lost revenue per hour. Revenue that flows through the affected operation in a typical hour, multiplied by the share that is actually lost rather than delayed. An order that a client places tomorrow instead is delayed; a trade that cannot be placed is lost.
• Idle staff cost per hour. The number of staff who cannot work, multiplied by their loaded hourly cost, multiplied by the share of their work that genuinely stops.
• Recovery cost. Overtime, provider call-outs and the hours spent catching up after the system returns. This often exceeds the outage itself.
• Contract and regulatory exposure. Service credits you must pay your own clients, penalties, and the cost of reporting to a regulator. The large surveys exclude most of this.

An illustrative example

The figures in this example are invented for illustration; they are not data. A 60-person Hong Kong investment adviser loses its order-management and email systems for three hours on a weekday morning:

• Lost revenue: it estimates HK$20,000 of fee revenue per trading hour passes through the systems, and that a quarter of it is genuinely lost rather than delayed: HK$5,000 an hour.
• Idle staff: 40 staff cannot work effectively, at a loaded cost of HK$400 an hour each, with 70% of their work stopped: about HK$11,200 an hour.
• Recovery: overtime and provider work after the outage of about HK$15,000 in total.
• Contract exposure: none triggered in this case, but the firm notes that a client mandate does require notification.

The three-hour outage costs about HK$63,600, or a little over HK$21,000 an hour. The point of doing the sum is not the total. It is the finding that, for this firm, idle staff cost more than lost revenue, which tells it where to spend: on keeping people working (alternative access, faster restoration of email), not only on the trading system.

What should the IT provider contract say about downtime?

Once you know your tolerance and your hourly cost, the provider contract should map to them. Most of the gaps we see are not in the uptime percentage but in what surrounds it.

• Priority definitions that match your critical operations. A "P1" in the contract should be an outage of something on your critical list, with a first response and an onsite response stated in hours. Brocent publishes its own P1 to P5 priority definitions, response and resolution targets and 8×5 or 24×7 service windows for this reason: a buyer should be able to read them before signing.
• Measurement that matches your tolerance. If your tolerance is measured per incident, a yearly uptime percentage is the wrong instrument. Ask for restoration targets per incident as well.
• Detection, not only response. The clock on downtime starts when a system fails, but the response clock usually starts when someone notices. Monitoring and a security operations centre that watches around the clock shorten the gap between failure and response, which is often where the hours are lost.
• Faster response costs more. Our own research on SLA response-time pricing premiums in Asia (Brocent research, labelled as such) sets out how much faster response tiers add to field service rates. A tolerance tighter than you need is expensive; one looser than you need is a risk you are carrying.
• Service credits are not compensation. A credit against next month's fee rarely comes close to the cost of the outage. Our scenario on SLA service credits and performance bonds covers that question in detail.

To see how these terms are priced for a Hong Kong office, you can build an indicative plan in our managed IT quote tool.

What does this report not claim?

• No Hong Kong or Singapore hourly cost figure. We found no published survey that measures the cost of an hour of downtime for firms in either market, and we have not invented one.
• No Brocent downtime statistics. Brocent is a managed IT and security provider. This report does not claim any figures from Brocent's own client base.
• No forecast. The survey figures describe past years. We do not project them forward.
• No legal advice. The regulatory positions are summarised from published notices and letters as of early November 2026. A regulated firm should read the text that applies to its own licence.

Frequently asked questions

How much does an hour of IT downtime cost?

For mid-size and large enterprises, over 90% of firms in ITIC's 2024 survey estimated more than US$300,000 an hour, and 41% estimated US$1 million to over US$5 million. These are respondents' estimates and exclude fines and litigation. For a firm of 30 to 300 staff, no reliable published figure exists; estimate your own from lost revenue, idle staff, recovery cost and contract exposure.

What is the MAS limit on unscheduled downtime?

MAS's technology risk management notices require that unscheduled downtime of each critical system that affects operations or customer service does not exceed a total of 4 hours within any 12 months, with a recovery time objective of no more than 4 hours. The notices apply to MAS-regulated financial institutions, each under the notice for its licence type.

Does the HKMA set a maximum downtime for banks?

Not as a fixed number. Under SPM module OR-2 Operational Resilience, each authorised institution sets its own tolerance for disruption for each critical operation, approved by its board. The HKMA reported in May 2026 that all authorised institutions had done so by the end of May 2026.

How much downtime does 99.9% uptime allow?

About 8.8 hours a year, or roughly 44 minutes a month, for a service measured around the clock. Check whether the contract measures monthly or yearly and whether planned maintenance is excluded.

Is there a US rule on acceptable downtime?

There is no single US rule that sets an hours limit across firms. Bank examiners expect recovery time objectives set through a business impact analysis, and incident notification rules set reporting deadlines rather than downtime limits. Acceptable downtime is mostly set by contract.

What is a recovery time objective (RTO)?

The RTO is the time within which a system must be restored after a disruption. MAS sets a maximum of 4 hours for critical systems of the institutions it regulates; elsewhere, a firm sets its own RTO from a business impact analysis and should test that it can meet it.

Are downtime cost surveys reliable?

They are reliable as a picture of what firms believe their exposure is, and as a sign of scale. They are not audited losses, they lean towards large organisations, and the best-known one excludes fines and litigation. Use them for context, and your own calculation for decisions.

Sources

Positions and figures as of 3 November 2026. ITIC, 2024 Hourly Cost of Downtime Survey (independent web survey, November 2023 to mid-March 2024). Uptime Institute, Annual Outage Analysis 2026, public announcement of 13 May 2026. Monetary Authority of Singapore: Notice FSM-N03 on Technology Risk Management (licensed insurers); notice of cancellation of Notices 644, 644A, 655, 655A, 1114 and 1118 (9 May 2024); Consultation Paper on Proposed Amendments to Notices on Technology Risk Management (June 2026). Hong Kong Monetary Authority: Supervisory Policy Manual module OR-2 Operational Resilience (31 May 2022); letter "Operational Resilience: Sustaining and Uplifting" (29 May 2026). FFIEC IT Examination Handbook, Business Continuity Management booklet (November 2019). Uptime arithmetic and the illustrative example are Brocent's own calculations.