Definition:
The Rule of 20 or the “20, 20, 20 rule” is an informal adage describing the typical lifecycle of a SIS.
- 20 weeks to design the SIS
- 20 months to implement and install the SIS
- 20 years to operate
This rule highlights that while the design and implementation phases are relativley short, the vast majorty of a SIS lifecyle is spent in operation and maintenance, over 90%.
Key Points:
- Ensures sufficient risk reduction layers.
- Used to screen when a single IPL is inadequate.
Example:
An event with 2E-2/yr frequency vs. 1E-3/yr tolerable risk would trigger Rule of 20.
Cited Source:
- CCPS Layer of Protection Analysis Guidelines.