Each outage of a cloud-hosted order system costs about USD 40,000 in lost sales and recovery, and two outages are expected per year. A safeguard costing USD 30,000 per year would cut the expected rate to one outage per year without changing the loss per outage. Based on annualized loss expectancy, is the safeguard cost-justified?
Select an answer to reveal the explanation.
Short Explanation
Here's the recipe: ALE equals what one bad day costs times how many bad days you expect a year. So you go from 40,000 times two, or 80,000, down to 40,000, saving 40,000 to spend 30,000, and that's a good deal. The trap is comparing the leftover risk to the cost instead of comparing the reduction to the cost.
Full Explanation
Quantitative risk analysis expresses risk in money. Single loss expectancy is the loss from one occurrence, here USD 40,000. The annualized rate of occurrence is the expected number of occurrences per year, two before the safeguard and one after. Annualized loss expectancy is SLE multiplied by ARO, so ALE is USD 80,000 before and USD 40,000 after. A safeguard's value is the ALE before, minus the ALE after, minus the annual cost of the safeguard: 80,000 minus 40,000 minus 30,000 leaves a positive USD 10,000, so the control is cost-justified. Calculating ALE as 40,000 falling to 20,000 divides by the rate rather than multiplying, which misstates both values. Comparing the residual USD 40,000 against the safeguard's cost confuses remaining risk with risk reduction; the decision depends on how much loss the control removes, and some residual risk is normal and is handled by acceptance or further treatment. Assuming the ALE falls to zero ignores the stated residual rate of one outage per year; few safeguards eliminate a risk entirely. Exam caveat: the safeguard's cost should include total annual cost of ownership, such as licensing and staff time, not just purchase price. Operational check: document the SLE, ARO and safeguard cost assumptions with their sources in the risk register so the calculation can be reviewed.