Question 1Objective 5.2
A server worth $40,000 would lose 25% of its value in a flood. Floods are expected once every 10 years. What is the annualized loss expectancy?
SLE, ARO and ALE, worked through
Three formulas turn a risk into money: how much one event costs, how often it happens and what that costs a year.
| SLE | Asset value × exposure factor |
|---|---|
| ARO | Expected events a year (once in 4 years is 0.25) |
| ALE | SLE × ARO |
A worked example
- A server worth $40,000 would lose 25% of its value in a flood: SLE = $40,000 × 0.25 = $10,000.
- Floods come once every 10 years: ARO = 0.1.
- ALE = $10,000 × 0.1 = $1,000 a year.
Is a control worth it?
Compare the drop in ALE with the control's yearly cost. If a $4,000-a-year control cuts the ALE from $10,000 to $2,000, it saves $8,000 for $4,000.
Try 3 questions
Question 2Objective 5.2
If a laptop is stolen, the company loses the $2,000 laptop and must spend $8,000 handling the exposure of the data on it. What is the single loss expectancy of a theft?
Question 3Objective 5.2
A company buys cyber insurance to cover the costs of a data breach. Which risk treatment is this?
Next step
Questions people ask
What is the exposure factor?
The share of an asset's value lost in one event, from 0 to 100%.
Is ARO always a whole number?
No. An event expected once every five years has an ARO of 0.2.