CompTIA Security+ guideHigh-value skills
Security+ Risk Calculations: SLE, ARO, and ALE
Work a $100,000 asset through exposure factor, single loss expectancy, and annualized loss expectancy, then compare an illustrative control.
Short answer
Single loss expectancy is asset value times exposure factor, in dollars per occurrence. Annualized loss expectancy is that amount times the annualized rate of occurrence. An ARO of 0.25 means you expect the event 0.25 times per year, not that a quarter of the asset is lost. All figures on this page are illustrative. They are not a bill and not a return on investment.
The formulas, with units
SY0-701 lists qualitative and quantitative risk analysis, and it names single loss expectancy (SLE), annualized loss expectancy (ALE), annualized rate of occurrence (ARO), and exposure factor. It also lists probability and likelihood as separate analysis ideas. This page only calculates the quantitative set. Recovery time and recovery point are a different page: recovery metrics.
| Term | Formula | Unit |
|---|---|---|
| Exposure factor (EF) | Percent of the asset lost in one event | A fraction, such as 0.20 |
| Single loss expectancy (SLE) | Asset value × EF | Dollars per occurrence |
| Annualized rate of occurrence (ARO) | How many times per year you expect the event | Occurrences per year |
| Annualized loss expectancy (ALE) | SLE × ARO | Dollars per year, as an expectation |
Qualitative analysis ranks impact with words such as high or low. It does not produce these dollar figures. Quantitative analysis does, and only inside the assumptions you stated.
The worked example
Asset value is $100,000. Exposure factor is 20%, so EF is 0.20. The event is expected once every four years, so ARO is 0.25 occurrences per year.
SLE = $100,000 × 0.20 = $20,000 per occurrence.
ALE = $20,000 × 0.25 = $5,000 per year.
Read that slowly. One event is expected to cost about $20,000, not the whole $100,000, because the exposure factor is 20%. Across a year you expect a quarter of an event, so the annualized figure is $5,000. That is not an invoice for $5,000. A quiet year can cost $0. A year with one event can cost about $20,000. The $5,000 is the average you would plan around if the assumptions hold.
ARO is not “a 25% chance the asset vanishes.” It is an occurrence rate. The exposure factor already says the event, when it happens, takes 20% of the asset. Multiplying 0.25 by $100,000 and skipping EF is a different and wrong problem.
A control that changes the assumptions
A control costs $1,800 per year. Assume it cuts the exposure factor from 0.20 to 0.10 and leaves the occurrence rate at 0.25. These numbers are made up so the arithmetic is visible.
New SLE = $100,000 × 0.10 = $10,000 per occurrence.
New ALE = $10,000 × 0.25 = $2,500 per year.
Expected loss falls by $5,000 − $2,500 = $2,500 per year. The control costs $1,800 per year. The expected annual outlay with the control is $2,500 + $1,800 = $4,300, compared with $5,000 without it. The difference is $700 per year of expected loss plus control cost, under these assumptions. It is not a guaranteed $700 refund, and it is not a percentage return. If the control only changes the loss when the event happens, and the event does not happen, you still paid $1,800.
Choosing the control is a risk decision. The controls guide is about what kind of control it is. This page only prices the assumption.
Four exercises
1. Asset value $40,000. EF 0.50. The event is expected every two years. SLE = $40,000 × 0.50 = $20,000. ARO = 0.5. ALE = $20,000 × 0.5 = $10,000 per year.
2. SLE is $8,000 and ALE is $2,000. ARO = ALE / SLE = $2,000 / $8,000 = 0.25 per year. You cannot recover the asset value from these two numbers, because EF is missing. SLE already combined asset value and EF.
3. Asset value $250,000. EF 0.04. The event is expected twice a year. SLE = $250,000 × 0.04 = $10,000. ARO = 2. ALE = $10,000 × 2 = $20,000 per year.
4. Someone computes 0.25 × $100,000 = $25,000 and calls it ALE for the worked example. That skipped the 20% exposure factor. The SLE is $20,000, and the ALE is $5,000. The $25,000 figure would only match a total loss (EF of 1) at an ARO of 0.25.
Use a Security+ item that asks for the annual figure when you want the same arithmetic in a stem. A percentage on that set is not an ALE.
Trust the source
Official sources
Exam policies can change. Use these primary sources for the most current details.