CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentMedium
A large e-commerce company is evaluating the risk of a major data breach. The risk manager calculates the Annualized Loss Expectancy (ALE) for this scenario. Given an Asset Value (AV) of $10,000,000, an Exposure Factor (EF) of 0.75, and an Annualized Rate of Occurrence (ARO) of 0.05, what is the ALE for this data breach scenario?
- A$1,250,000
- B$1,000,000
- C$375,000
- D$750,000
Show answer & explanationAnswer & explanation
Correct answer: C. $375,000
The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO). SLE is calculated as Asset Value (AV) multiplied by Exposure Factor (EF). SLE = AV * EF = $10,000,000 * 0.75 = $7,500,000. ALE = SLE * ARO = $7,500,000 * 0.05 = $375,000.
Why the other options are wrong
- A. Incorrect calculation, a common error might be misinterpreting the formula or values.
- B. Incorrect calculation, possibly AV * ARO.
- D. Incorrect calculation, perhaps only multiplying AV by ARO and EF by ARO separately.
Annualized Loss Expectancy (ALE)
The expected monetary loss from a risk event over a one-year period, calculated as SLE multiplied by ARO.
- Quantitative measure of risk.
- Helps in justifying security investments.
- Requires accurate estimation of SLE and ARO.
Memory trick: ALE is like an annual bill for expected losses.