ISC2 Certified in Cybersecurity (CC)Security PrinciplesMedium
A critical infrastructure organization manages a Supervisory Control and Data Acquisition (SCADA) system. They have determined that a single outage event on a specific control server could lead to a loss of $50,000. Historical data indicates that this type of outage occurs approximately once every two years. What is the Annualized Loss Expectancy (ALE) for this specific risk?
- A$25,000
- B$100,000
- C$50,000
- D$125,000
Show answer & explanationAnswer & explanation
Correct answer: A. $25,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this case, SLE = $50,000 and ARO = 0.5 (1 occurrence / 2 years). So, ALE = $50,000 * 0.5 = $25,000.
Why the other options are wrong
- B. This would be the ALE if the event occurred twice a year (50,000 * 2), which is incorrect.
- C. This is the Single Loss Expectancy (SLE), not the Annualized Loss Expectancy (ALE).
- D. This calculation is incorrect for the given values.
Annualized Loss Expectancy (ALE)
The estimated financial loss from a specific risk over a one-year period. It quantifies risk in monetary terms.
- Calculated as SLE * ARO.
- Helps prioritize risk mitigation efforts.
- Expressed in monetary value per year.
Memory trick: ALE is the total loss you'd expect to feel, annually.