SSCP Systems Security Certified PractitionerRisk Identification, Monitoring, and AnalysisMedium
A financial institution is evaluating the risk associated with a potential data breach. They estimate that if a breach occurs, it has a 30% chance of happening annually. The single loss expectancy (SLE) for such an event is calculated to be $500,000, considering direct costs, regulatory fines, and reputational damage. What is the Annualized Loss Expectancy (ALE) for this risk?
- A$150,000
- B$1,500,000
- C$5,000,000
- D$15,000
Show answer & explanationAnswer & explanation
Correct answer: A. $150,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this case, ALE = $500,000 * 0.30 = $150,000.
Why the other options are wrong
- B. Incorrect calculation: $500,000 * 3 = $1,500,000. This treats the percentage as a multiplier of 3.
- C. Incorrect calculation: This represents a significantly higher ARO or SLE than given.
- D. Incorrect calculation: $500,000 * 0.03 = $15,000. This uses 3% instead of 30%.
Annualized Loss Expectancy (ALE)
The expected monetary loss for an asset or a specific risk over a one-year period. It is a key metric in quantitative risk analysis.
- Calculated as SLE x ARO.
- SLE is Single Loss Expectancy (cost per incident).
- ARO is Annualized Rate of Occurrence (frequency per year).
Memory trick: SLE x ARO = ALE to Calculate Loss Annually.