A data breach scenario has a single loss expectancy of $200,000 and an annual rate of occurrence of 0.25. A proposed control costs $30,000 a year and would reduce the annual rate of occurrence to 0.05. What is the annualized loss expectancy before the control, and is the control cost-justified?
Select an answer to reveal the explanation.
Short Explanation
ALE is just SLE times ARO, so $200,000 times 0.25 gives you $50,000 a year. The control knocks that down to $10,000, saving $40,000 for a $30,000 price tag, so it pays its way. The trap is comparing the control cost to the leftover loss instead of to the reduction it buys you.
Full Explanation
Annualized loss expectancy is single loss expectancy multiplied by the annual rate of occurrence: $200,000 × 0.25 = $50,000 per year. With the control, the rate falls to 0.05, so the new figure is $200,000 × 0.05 = $10,000. The control therefore reduces expected annual loss by $40,000 while costing $30,000 a year, a net benefit of $10,000, so it is cost-justified on these figures. Dividing the single loss expectancy by the rate, which yields $800,000, inverts the formula and overstates the exposure fourfold. Comparing the control's cost with the residual $10,000 confuses the loss that remains with the loss that is avoided; a control is justified by the reduction it delivers relative to its cost. Treating the single loss expectancy as the annual figure ignores frequency entirely, and requiring a control to eliminate a scenario before funding it contradicts risk-based management, which aims for acceptable rather than zero risk. Exam caveat: quantitative results support decisions but rely on the quality of their estimates, and non-financial impacts such as reputation should still be considered. Operational check: document the inputs and their sources, recompute both values, and record the cost-benefit result with the risk owner's treatment decision.