Which metric is used to estimate the expected annual monetary loss due to risk?

• A. The total value of assets owned by an organization.
• B. The expected annual monetary loss due to risk.
• C. The probability of a successful attack per year.
• D. The time to recover from a loss event.

Answer: (B)

Estimating the expected annual monetary loss due to risk uses a metric that combines how big a loss could be in a single incident with how often such incidents are expected to occur in a year. This is the Annualized Loss Expectancy (ALE).

ALE is calculated by multiplying Single Loss Expectancy (SLE) by Annualized Rate of Occurrence (ARO). SLE represents the monetary impact of one event, usually derived from the asset’s value and how much of that value would be lost in a compromise (for example, asset value times the exposure factor). ARO is the expected number of such events per year. For instance, if a critical asset is valued at $100,000 and a single incident could damage 30% of it (SLE = $30,000), and such incidents are expected to happen 0.1 times per year (ARO = 0.1), then ALE = $3,000 per year. This figure helps prioritize controls by showing how much money is at risk on an annual basis.

The other options aren’t the metric for expected annual monetary loss: total asset value is just the amount at risk, not the frequency or the monetary impact of incidents; probability of a successful attack per year is the ARO in probabilistic form but not the monetary loss; time to recover is about recovery speed, not the monetary impact per year.