Lessons · Cybersecurity · annualised loss expectancy
What it costs a year: annualised loss expectancy
The annualised rate of occurrence is how many times a year you expect it, and the annualised loss expectancy is the single loss expectancy multiplied by that rate.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
A control that costs 12,000 dollars a year is either a bargain or absurd, and the only thing that decides which is the yearly cost of the thing it prevents. This is the number you put beside the price.
How to think about it
Get the rate from history where you can: three times in five years is 3 / 5 = 0.6 a year. Once in ten years is 0.1. Twice a year is 2. Then multiply by the single loss expectancy and say per year out loud, so the units stay attached.
Worked example
ARO = times per year you expect itFrom your own history, or from the industry's, or from an honest estimate.
Once in five years: ARO = 1 / 5 = 0.2A rate smaller than one is normal and is not a probability of anything else.
ALE = SLE * AROThe second line of the arithmetic.
ALE = 50,000 * 0.2 = 10,000 per yearA 50,000 dollar event expected once in five years costs 10,000 dollars a year.
Your turn
An event with an SLE of 8,000 dollars that is expected twice a year. Write the line that gives the ALE.
ALE = 8000 *
Solve one, graded on the server
The trap
Refusing to write a rate because you cannot prove it. A stated estimate can be argued with and improved; a blank means the decision gets made on whoever spoke last.