What does the Annual Loss Expectancy (ALE) represent?

• A. The expected monetary loss for an asset due to a risk over a year.
• B. The maximum possible loss from a risk event.
• C. The annual budget allocated for risk mitigation.
• D. The time to recover from a breach.

Answer: (A)

ALE represents the average financial impact you can expect from a risk over the course of a year. It combines two pieces: how much you would lose if the threat happens once (Single Loss Expectancy) and how often such incidents are expected to occur in a year (Annualized Rate of Occurrence). So, ALE = SLE × ARO. For example, if a single incident could cost $60,000 (SLE) and you expect such incidents 0.2 times per year (ARO), the ALE would be $12,000 per year. This metric helps prioritize security controls by showing the expected yearly loss, rather than the maximum possible loss or a one-time cost, and is different from concepts like recovery time or budget.