CISSP Quantitative Risk Analysis Formulas

Single Loss Expectancy (SLE)

Is the monetary loss that is expected each time a risk materializes. SLE = Asset Value x Exposure Factor (SLE=AV x EF)

Annualized Loss Expectancy (ALE)

Is the monetary loss that the business expects to occur as a result of a risk harming the asset over the course of the year. Determined: ALE = Single Loss Expectancy X Annualized Rate of Occurance (ALE = SLE x ARO)

Exposure Factor (EF)

Represents the percentage of loss an organization would experience if a specific asset were violated by a realized risk.

Annual Cost of the Safeguard (ACS)

Should never be more than the annual cost of the asset. $/year

Annualized Rate of Occurrence (ARO)

is expected frequency with which a specific threat or risk will occur within a single year (pre-countermeasure ALE - post-countermeasure ALE)-ACS (ALE1-ALE2)-ACS