Certified Information Security Manager (CISM)Information Security Risk ManagementEasy
An organization is conducting a quantitative risk assessment for a critical business application. The Annualized Rate of Occurrence (ARO) for a specific type of cyberattack is estimated to be 0.5 (meaning it's expected to occur once every two years). The Single Loss Expectancy (SLE) for this attack is calculated as $200,000. What is the Annualized Loss Expectancy (ALE) for this cyberattack?
- A$200,000
- B$50,000
- C$400,000
- D$100,000
Show answer & explanationAnswer & explanation
Correct answer: D. $100,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). So, ALE = $200,000 * 0.5 = $100,000.
Why the other options are wrong
- A. This would be the SLE, not the ALE.
- B. This would imply an ARO of 0.25, not 0.5.
- C. This would imply an ARO of 2, not 0.5.
Annualized Loss Expectancy (ALE)
The expected monetary loss from a risk over a one-year period, calculated as the product of Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO).
- Used in quantitative risk assessment.
- Helps prioritize security investments.
- ALE = SLE × ARO.
Memory trick: ALE is SLE times ARO, like a yearly loss total.