CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityMedium
A manufacturing company relies heavily on an industrial control system (ICS) for its production line. A recent vulnerability scan identified several unpatched systems and weak authentication mechanisms within the ICS network. The risk manager calculates the potential annual loss expectancy (ALE) from a successful cyberattack on the ICS. Given an Asset Value (AV) of $5,000,000, an Exposure Factor (EF) of 0.40, and an Annualized Rate of Occurrence (ARO) of 0.25, what is the ALE?
- A$1,250,000
- B$500,000
- C$4,000,000
- D$2,000,000
Show answer & explanationAnswer & explanation
Correct answer: B. $500,000
The Annual Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO). First, calculate SLE = AV * EF = $5,000,000 * 0.40 = $2,000,000. Then, ALE = SLE * ARO = $2,000,000 * 0.25 = $500,000.
Why the other options are wrong
- A. This would be SLE / (1/ARO) if ARO was 0.25, or if SLE was $5,000,000 / 4.
- C. This is AV * 0.80, or might be a miscalculation involving ARO.
- D. This is the Single Loss Expectancy (SLE) before considering ARO.
Annual Loss Expectancy (ALE)
The expected monetary loss that an organization can expect from a specific risk over a one-year period.
- Calculated using SLE and ARO.
- SLE (Single Loss Expectancy) = Asset Value (AV) * Exposure Factor (EF).
- ALE = SLE * ARO (Annualized Rate of Occurrence).
Memory trick: SLE is the single hit, ALE is the annual total.