CISSP Risk Calculations: SLE, ALE, ARO and Whether a Control Is Worth Its Cost

ISC2's CISSP outline never prints a risk formula. Objective 1.9, "Understand and apply risk management concepts," lists risk analysis, assessment and scope, and risk response and treatment, and ISC2's Candidate Information Bulletin says exams can include calculation items. Put together, that means a CISSP candidate should be able to turn a short scenario into a loss figure and a decision. The method below is the standard quantitative approach taught for the CISSP, with NIST's definitions where NIST provides them. It applies to both the 2024 outline and the 2027 outline, which keeps objective 1.9 and adds "risk mitigation strategies" as an example.

The five quantities in CISSP risk math

NIST's IR 8286Ar1 (December 2025) describes the two outputs the same way: SLE as the loss for each occurrence, and ALE as the total loss for that risk over an annual period. The formulas in the right-hand column are the arithmetic that connects them.

A worked example (original, Passy's numbers). A customer database is valued at $1,200,000. A breach would cost 40% of that value (the exposure factor), and analysts expect such a breach about once every eight years.

1. SLE = $1,200,000 × 0.40 = $480,000
2. ARO = 1 ÷ 8 = 0.125
3. ALE = $480,000 × 0.125 = $60,000 a year

Turning "once every N years" into an ARO

A common slip happens here, because scenarios rarely say "ARO." They say how often.

The ARO is a rate per year, not a number of years. If you find yourself multiplying an SLE by 8 because the event happens "every 8 years," stop: the ALE should shrink as events get rarer, not grow.

Is a CISSP safeguard worth it? The cost-benefit test

The standard comparison taught in CISSP prep (neither ISC2's outline nor NIST prints it as a formula):

Value of the safeguard = ALE before − ALE after − annual cost of the safeguard

A positive result means the control saves more each year than it costs. A negative result means that, on the numbers alone, it doesn't pay.

Continuing the database example, with two candidate controls:

Control A is justified; Control B costs more than the risk it removes. Notice that both controls reduce risk by the same amount. The question isn't which control is stronger but which one is worth its cost.

A control can also work on the exposure factor instead of the ARO. Suppose a separate risk to the same database, ransomware, has the same figures: 40% exposure, once every eight years, an ALE of $60,000. Immutable offsite backups costing $20,000 a year would cut the damage to 10% of the asset's value without changing how often attacks happen. SLE after = $1,200,000 × 0.10 = $120,000, ALE after = $120,000 × 0.125 = $15,000, and the value is $60,000 − $15,000 − $20,000 = $25,000.

One-time costs. If a control has a purchase price, convert it to a yearly figure before comparing it with an ALE. A simple approach (Passy's simplification): spread the purchase over its useful life and add yearly support. A $90,000 system used for three years with $5,000 a year of support costs $90,000 ÷ 3 + $5,000 = $35,000 a year.

Security and Risk Management, where this arithmetic sits, is the heaviest domain under the 2024 outline at 16%, and it carries the largest share of the planned CISSP question bank.

Residual risk and the risk responses NIST names

After a control is in place, some risk remains. NIST SP 800-30 Rev. 1 defines residual risk as the portion of risk remaining after security measures have been applied. In the example above, Control A leaves $12,000 a year of residual ALE, and someone with the authority to do so has to accept it.

NIST SP 800-39 lists the ways an organization can respond to risk:

NIST adds a point worth remembering for scenario items: transferring risk through insurance reduces neither the likelihood of the harmful event nor its consequences. It moves the financial liability, not the incident. Ignoring a risk isn't on NIST's list at all.

Quantitative, qualitative and semi-quantitative analysis

NIST SP 800-30 Rev. 1 describes three approaches:

• Quantitative uses numbers whose meaning holds outside the assessment, like the dollar figures above. NIST says it best supports cost-benefit analysis, but warns that its rigor drops when subjective guesses hide inside the numbers.
• Qualitative uses categories such as very low to very high. NIST says it helps communicate risk to decision makers but makes fine comparisons hard.
• Semi-quantitative uses scales or bins, such as 1 to 10, that translate easily into qualitative terms while allowing relative comparisons.

A question that asks which approach supports a budget decision about a specific control points to quantitative analysis. A question about quickly ranking dozens of risks for executives points to qualitative or semi-quantitative.

Five traps in CISSP risk calculation items

These are common patterns in practice questions, not ISC2 findings:

1. Answering with the SLE when the question asks for the ALE, or the reverse. Underline which one the stem wants.
2. Using years instead of a rate for the ARO. Once every 5 years is 0.2, not 5.
3. Comparing a one-time loss with a yearly cost. Compare ALE with annual cost, or SLE with a one-time figure, never across.
4. Forgetting to subtract the control's cost. The biggest ALE reduction isn't automatically the best choice.
5. Letting the numbers override everything. If a control protects human life or is legally required, a negative cost-benefit result doesn't settle the question, as the think like a manager guide explains.

When a calculation goes wrong in practice, the useful step is to find which link in the chain broke: AV, EF, ARO or the comparison. Fix It in the planned CISSP prep keeps every missed calculation for another try.

CISSP risk practice items written by Passy

These are original items, not ISC2 questions. Cover the reasoning and try each first.

1. A branch office's equipment is valued at $250,000. A fire would destroy 60% of it, and fires are expected about once every 25 years. What is the ALE?

Keyed answer: $6,000. SLE = $250,000 × 0.60 = $150,000. ARO = 1 ÷ 25 = 0.04. ALE = $150,000 × 0.04 = $6,000. A common wrong answer is $150,000, which is the SLE.

2. An upgraded sprinkler system for the same office costs $9,000 a year and would cut the fire's exposure factor to 20%. On the numbers alone, is it justified?

Keyed answer: no. SLE after = $250,000 × 0.20 = $50,000, ALE after = $50,000 × 0.04 = $2,000, and the value is $6,000 − $2,000 − $9,000 = −$5,000. But sprinklers protect people and may be required by fire codes, so a real decision wouldn't rest on this result alone.

3. A company buys a cyber insurance policy that pays for breach-response costs. Which risk response is this, and what doesn't it change?

Keyed answer: risk transfer. It shifts the financial liability to the insurer. It doesn't change how likely a breach is or the operational and reputational harm one causes.

Practicing CISSP risk math this week

Write the chain on one line, AV × EF = SLE, SLE × ARO = ALE, and solve three scenarios a day for a week, converting every "once every N years" before you multiply. The 20 free CISSP practice questions include an ALE item to check yourself against. For recovery-time math, which uses hours rather than dollars, continue with the CISSP BCP and disaster recovery guide, and if Domain 1 turns out to be your weakest area, planned CISSP prep's Weak Spot drill targets your lowest-accuracy domain five questions at a time.