Certified Information Security Manager (CISM)Information Security Risk ManagementMedium
An organization is considering the implementation of a new security control that will cost $50,000 annually. This control is expected to reduce the likelihood of a specific incident, which currently has an Annualized Loss Expectancy (ALE) of $200,000, by 75%. What is the Annualized Savings of this new control?
- A$150,000
- B$125,000
- C$200,000
- D$100,000
Show answer & explanationAnswer & explanation
Correct answer: D. $100,000
The reduction in ALE is 75% of $200,000, which is $150,000. Subtracting the annual cost of the control ($50,000) from this reduction gives the Annualized Savings: $150,000 - $50,000 = $100,000.
Why the other options are wrong
- A. This value represents the reduction in ALE, not the net annualized savings after accounting for control cost.
- B. This value incorrectly subtracts the cost from the total ALE or miscalculates the reduction.
- C. This value represents the original ALE, not the savings from implementing the control.
Annualized Savings
The net financial benefit realized from implementing a security control, calculated by subtracting the annual cost of the control from the reduction in Annualized Loss Expectancy (ALE).
- Measures the financial gain of a security control.
- Calculated as (ALE reduction - control cost).
- Helps justify security investments.
Memory trick: Savings = (ALE reduction) - (Control Cost).