CompTIA Security+ (SY0-701)Security Program Management and OversightHard
A company currently suffers a successful ransomware attack about once every 2 years, with an average loss of $400,000 per incident. Implementing a new EDR solution costing $50,000 annually is expected to reduce the occurrence to once every 5 years. Based on ALE analysis, what is the net financial benefit of implementing the control, and should it be implemented?
- A$120,000 net savings; implement because raw savings exceed the control cost
- B$50,000 net savings; do not implement
- C$70,000 net savings; implement because the benefit exceeds the control cost
- D$200,000 net savings; implement regardless of cost
Show answer & explanationAnswer & explanation
Correct answer: C. $70,000 net savings; implement because the benefit exceeds the control cost
ALE before = $400,000/2 = $200,000. ALE after = $400,000/5 = $80,000. Reduction in ALE = $200,000 − $80,000 = $120,000. Subtracting the $50,000 annual control cost gives a net benefit of $70,000, so the control should be implemented since it produces a positive net benefit.
Why the other options are wrong
- A. This is the gross ALE reduction but omits subtracting the control's cost.
- B. This figure ignores the actual ALE reduction calculation.
- D. This uses the pre-control ALE figure incorrectly and ignores cost.
Cost-Benefit Analysis of Controls
Comparing the reduction in ALE achieved by a control against the annual cost of that control determines whether implementation is financially justified.
- ALE = SLE × ARO
- Net benefit = (ALE before − ALE after) − control cost
- Positive net benefit justifies implementing the control
Memory trick: Savings Minus Spending Equals Sensible Decision