CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentMedium
A financial services organization is assessing the risks associated with its new cloud-based customer relationship management (CRM) system. During the risk analysis, it is determined that a critical vulnerability exists in the system's authentication module. Remediation efforts are estimated to cost $50,000, and the likelihood of a successful exploit resulting in a data breach is 20% annually. If a data breach occurs, the estimated loss is $2,000,000. What is the Annualized Loss Expectancy (ALE) for this specific risk, assuming the vulnerability is NOT remediated?
- A$10,000
- B$2,000,000
- C$400,000
- D$450,000
Show answer & explanationAnswer & explanation
Correct answer: C. $400,000
Annualized Loss Expectancy (ALE) is calculated by multiplying the Annualized Rate of Occurrence (ARO) by the Single Loss Expectancy (SLE). In this scenario, ARO is 20% (0.20) and SLE is $2,000,000. Therefore, ALE = 0.20 * $2,000,000 = $400,000. Remediation costs are irrelevant for calculating the ALE of the risk if it is NOT remediated.
Why the other options are wrong
- A. This value is incorrect; it might result from an incorrect calculation or misinterpretation of the inputs.
- B. This represents the Single Loss Expectancy (SLE), not the Annualized Loss Expectancy (ALE).
- D. This incorrectly adds the remediation cost to the ALE, which is not part of the ALE calculation if the risk is not remediated.
Annualized Loss Expectancy (ALE)
The expected monetary loss for an asset or information resource due to a risk over a one-year period.
- Calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO).
- Used to quantify financial impact of risks.
- Helps prioritize risk mitigation efforts based on financial impact.
Memory trick: Annual Loss is just Rate times Single Event.