CompTIA SecurityX (CAS-005)Governance, Risk and ComplianceEasy
A company is conducting a risk assessment for its new customer relationship management (CRM) system. The system processes sensitive customer data, and a data breach could result in significant regulatory fines and reputational damage. The likelihood of a successful attack is estimated at 0.05 per year, and the potential financial loss from such an event is estimated to be $2,000,000. What is the Annualized Loss Expectancy (ALE) for this risk?
- A$10,000
- B$2,000,000
- C$200,000
- D$100,000
Show answer & explanationAnswer & explanation
Correct answer: D. $100,000
Annualized Loss Expectancy (ALE) is calculated by multiplying the Annualized Rate of Occurrence (ARO) by the Single Loss Expectancy (SLE). In this case, ARO = 0.05 and SLE = $2,000,000. Therefore, ALE = 0.05 * $2,000,000 = $100,000.
Why the other options are wrong
- A. Incorrect calculation. This would be 0.005 * $2,000,000.
- B. This represents the Single Loss Expectancy (SLE), not the Annualized Loss Expectancy (ALE).
- C. Incorrect calculation. This would be 0.1 * $2,000,000.
Annualized Loss Expectancy (ALE)
The expected monetary loss that can be anticipated from a risk over a one-year period. It is calculated as the product of Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO).
- Measures annual financial risk.
- Calculated as SLE x ARO.
- Used in quantitative risk assessment.
Memory trick: SLE-ARO-ALE: Single, Annual Rate, Annual Expectancy.