D1 — Quantitative Risk Management: ALE, SLE, ARO
How CISSP actually measures risk in dollars: single loss expectancy, annualized rate of occurrence, annualized loss expectancy — and why the manager answer sometimes rejects a safeguard that would work perfectly.
Learning Objectives
- → Compute SLE, ARO, and ALE from given inputs, and use ALE to judge whether a safeguard is worth its cost
- → Explain the four risk treatment options — mitigate, transfer, avoid, accept — and when acceptance is the correct answer, not a failure
- → Distinguish quantitative from qualitative risk analysis and identify when each is the appropriate tool
- → Apply the manager mindset to reject a safeguard that reduces risk toward zero but costs more than the risk it removes
Lesson 1 established that governance means someone is accountable for a decision. This lesson gives you the actual arithmetic CISSP expects that decision to be based on — because "reduce risk" is not, by itself, a defensible answer. How much risk, at what cost, is.
The three numbers
- Asset Value (AV) — what the asset is worth, in currency, to the organization.
- Exposure Factor (EF) — the percentage of that asset's value lost if the risk event happens once. A ransomware event that would corrupt roughly 40% of a media archive's undeduplicated value has an EF of 0.4, not 1.0 — plenty is backed up or unaffected.
- Single Loss Expectancy (SLE) = AV × EF. The dollar cost of one occurrence.
- Annualized Rate of Occurrence (ARO) — how many times per year the event is expected to happen. An event expected once every 4 years has an ARO of 0.25; an event expected 3 times a year has an ARO of 3.
- Annualized Loss Expectancy (ALE) = SLE × ARO. The expected dollar cost of this risk, per year, averaged over time.
Worked example: A media company's video-on-demand archive is valued at 2,000,000 MAD. A ransomware event is estimated to corrupt 40% of it before containment (EF = 0.4), giving an SLE of 800,000 MAD. Based on incident history across similar platforms, this class of event is expected roughly once every 5 years (ARO = 0.2). ALE = 800,000 × 0.2 = 160,000 MAD/year — the risk is "worth," in expectation, 160,000 MAD of exposure annually, independent of whether it happens this year or not at all.
Reading a safeguard's value
A safeguard is justified only when the ALE it removes exceeds its annualized cost:
Value of the safeguard = (ALE before) − (ALE after) − (annualized cost of the safeguard)
If that value is negative, the safeguard destroys value — even if it drives residual risk close to zero. This is the single most commonly tested calculation in this domain, and it is also the point where a strong technical instinct actively misleads: a technician's reflex is "this control would stop the problem, so implement it." CISSP's reflex is "does removing this much annual risk justify this much annual cost, or does the money do more good somewhere else in the risk register?"
Four risk treatments
Reducing a risk to zero is one option among four, not the default goal:
| Treatment | What it means | When it's right |
|---|---|---|
| Mitigate | Reduce likelihood or impact with a control | Cost of the control is less than the ALE reduction it produces |
| Transfer | Shift financial impact elsewhere (insurance, contract) | The premium/cost of transfer is below the ALE, and the org doesn't want to hold the exposure directly |
| Avoid | Eliminate the activity that creates the risk entirely | The activity's value doesn't justify the exposure at any achievable control cost |
| Accept | Formally acknowledge and take no further action | The cost of any available treatment exceeds the ALE — acceptance is the rational choice here, not a shortcut |
Risk acceptance is frequently the exam's correct answer specifically because test-takers with an operational background instinctively distrust it — "doing nothing" feels wrong when you're the person who'd get paged if the risk materializes. CISSP tests whether you can separate that operational instinct from the financial logic: formally accepted, documented, low-cost-to-treat risk is a sign of mature risk management, not negligence. Undocumented, un-acknowledged risk is the actual failure mode.
Qualitative vs quantitative analysis
Quantitative analysis (the ALE math above) requires real historical data — loss history, actuarial figures, reliable AV/EF/ARO estimates. Many risks don't have that data available, or the effort to obtain it isn't justified by the decision's stakes. Qualitative analysis — ranking risks on a High/Medium/Low or 1-5 scale using expert judgment, often via a risk matrix crossing likelihood against impact — is the appropriate tool when precision isn't achievable or worth the cost. CISSP expects you to recognize which situation you're in, not to insist on quantitative rigor everywhere.
The CISSP mindset: manager vs technician
A vendor proposes a control costing 400,000 MAD/year that would reduce the ransomware risk above to near-zero.
The technician answer: implement it — it directly addresses the vulnerability and the residual risk afterward is negligible. From a pure "does it work" standpoint, this is correct.
The manager (CISSP) answer: compare 400,000 MAD/year against the 160,000 MAD/year ALE it removes. The control costs more than 2.5× the risk it eliminates — a net loss of 240,000 MAD/year in expectation. The correct answer is to decline this specific control and instead look for a cheaper mitigation, a transfer option (cyber insurance) below 160,000 MAD/year, or formal acceptance if nothing cheaper is available — never to buy risk reduction at a price above what the risk itself costs. Effectiveness alone was never the question; cost-justified effectiveness was.
An organization's customer database is valued at 5,000,000 MAD. A specific breach scenario is estimated to expose and require full remediation of 20% of that value (EF = 0.2). Industry incident data suggests this scenario occurs, on average, once every 8 years for organizations of similar size and posture. Calculate the SLE and the ALE, showing your work.
What is the SLE, and what is the ALE for this scenario?
Using the ALE of 125,000 MAD/year computed above, a proposed control costs 90,000 MAD/year and would reduce the ALE to approximately 10,000 MAD/year. A second, more aggressive control costs 200,000 MAD/year and would reduce the ALE to near 0. Which control, if either, is the financially justified choice, and why?
Which control is financially justified, and why?
A small, low-traffic internal tool carries a risk with an ALE of 3,000 MAD/year. The cheapest available mitigating control costs 15,000 MAD/year to implement and maintain. No insurance product covers this specific risk, and the tool is business-critical (avoidance isn't realistic). What is the correct risk treatment here, and is choosing it a sign of poor risk management?
What is the correct risk treatment, and is it a sign of poor risk management?