A server is valued at $200,000. If a specific flood scenario occurs, 25 percent of the server's value would be lost, and that flood is expected to occur once every two years. What is the annualized loss expectancy (ALE) for this risk?
Select an answer to reveal the explanation.
Short Explanation
Work it in two moves: SLE is value times exposure factor, so $200,000 times 25 percent is $50,000. Once every two years is an ARO of 0.5, and $50,000 times 0.5 gives you $25,000. The trap is stopping at the SLE, which is one event, not one year.
Full Explanation
Quantitative risk analysis builds the annualized loss expectancy in two steps. Single loss expectancy equals asset value multiplied by exposure factor, which is the fraction of the asset lost in one occurrence: $200,000 multiplied by 0.25 gives an SLE of $50,000. The annualized rate of occurrence expresses how many times per year the event is expected; once every two years is an ARO of 0.5. ALE equals SLE multiplied by ARO, so $50,000 multiplied by 0.5 gives $25,000 per year. Fifty thousand dollars is the single loss expectancy, the cost of one flood, and treating it as the annual figure ignores that the flood happens only every other year. One hundred thousand dollars results from multiplying the full asset value by the ARO and skipping the exposure factor, which overstates the loss because only a quarter of the value is lost per event. Twelve thousand five hundred dollars comes from multiplying the SLE by the exposure factor a second time, a double count with no meaning in the formula. Exam caveat: ALE is mainly used to justify controls; a control whose annual cost exceeds the reduction in ALE is hard to justify on financial grounds. Operational check: write out asset value, exposure factor, SLE, ARO, and ALE explicitly before comparing any control's annual cost against the result.