CompTIA SecurityX (CAS-005)Governance, Risk and ComplianceMedium
A financial institution is evaluating its risk exposure to cyberattacks. They estimate that a successful data breach would result in a direct loss of $500,000 in recovery costs and regulatory fines. They also estimate an indirect loss of $1,500,000 due to reputational damage and customer churn. Historical data suggests there is a 20% chance of such a breach occurring in any given year. What is the Annualized Loss Expectancy (ALE) for this specific risk?
- A$100,000
- B$400,000
- C$2,000,000
- D$300,000
Show answer & explanationAnswer & explanation
Correct answer: B. $400,000
The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE is the sum of direct and indirect losses ($500,000 + $1,500,000 = $2,000,000). ARO is 20% or 0.2. Therefore, ALE = $2,000,000 * 0.2 = $400,000.
Why the other options are wrong
- A. Incorrect. This would be SLE of $500,000 * 0.2.
- C. Incorrect. This is the total Single Loss Expectancy (SLE), not the ALE.
- D. Incorrect. This would be SLE of $1,500,000 * 0.2.
Annualized Loss Expectancy (ALE)
The expected monetary loss for a given risk over a one-year period.
- ALE = SLE * ARO.
- SLE = Single Loss Expectancy (total cost of a single event).
- ARO = Annualized Rate of Occurrence (probability of event per year).
Memory trick: ALE is your yearly cost, SLE times ARO.