CompTIA SecurityX (CAS-005)Governance, Risk and ComplianceMedium
An organization is evaluating its risk management program. The CISO wants to understand the financial impact of a potential data breach. They estimate that a breach would cost approximately $2,000,000 per incident and has a 25% chance of occurring in a given year. The organization has comprehensive cyber insurance that covers 75% of the financial loss for any single incident. What is the Single Loss Expectancy (SLE) for this data breach WITHOUT considering the insurance coverage?
- A$1,500,000
- B$4,000,000
- C$500,000
- D$2,000,000
Show answer & explanationAnswer & explanation
Correct answer: D. $2,000,000
Single Loss Expectancy (SLE) is the financial loss expected from a single security incident. It is calculated as Asset Value (AV) multiplied by Exposure Factor (EF). In this scenario, the direct financial loss per incident is given as $2,000,000. The probability and insurance coverage are factors for Annualized Loss Expectancy (ALE) and risk transference, respectively, not SLE.
Why the other options are wrong
- A. $1,500,000 would be the remaining loss after insurance coverage ($2,000,000 * 0.75).
- B. $4,000,000 is an incorrect calculation.
- C. $500,000 is the Annualized Loss Expectancy (ALE) if calculated as $2,000,000 * 0.25 (probability).
Single Loss Expectancy (SLE)
The expected monetary loss from a single occurrence of a risk event.
- Calculated as Asset Value (AV) * Exposure Factor (EF).
- Represents the financial impact of one incident.
- A component of quantitative risk analysis.
Memory trick: SLE is the single hit, ALE is the yearly sum.