ISC2 Certified in Cybersecurity (CC)Security PrinciplesMedium
A cyber insurance company is assessing the potential financial losses for a client due to a data breach. They estimate that if a breach occurs, the direct costs (investigation, notification, fines) and indirect costs (reputation damage, lost business) would sum up to $2 million. This estimate represents which component of risk quantification?
- ASingle Loss Expectancy (SLE)
- BExposure Factor (EF)
- CAnnualized Rate of Occurrence (ARO)
- DAnnualized Loss Expectancy (ALE)
Show answer & explanationAnswer & explanation
Correct answer: A. Single Loss Expectancy (SLE)
Single Loss Expectancy (SLE) is the monetary value that is expected to be lost if an asset is compromised a single time. It includes both tangible and intangible costs associated with a single event.
Why the other options are wrong
- B. EF is the percentage of an asset's value that would be lost if a specific threat were to materialize.
- C. ARO is the frequency of an event occurring in a year, not the financial loss per event.
- D. ALE is the total expected loss over a year, calculated as SLE * ARO.
Single Loss Expectancy (SLE)
The monetary loss expected each time a specific threat materializes. It represents the value of a single loss event.
- Includes direct and indirect costs.
- A component of ALE calculation.
- Expressed as a single monetary value.
Memory trick: SLE is the 'ouch' of one event.