16.4 Cost, Benefit, and Practical Decision Making
The SLE, ARO, ALE Chain
Quantitative costing uses three named quantities. Single Loss Expectancy is the value destroyed in one event: SLE = Asset Value x Exposure Factor, so a $10,000 database whose compromise ruins half its worth carries an SLE of $5,000. Annual Rate of Occurrence is how often you expect the event per year -- half a break-in per year is ARO 0.5, a weekly ransomware wave is 52. Annual Loss Expectancy multiplies them: ALE = SLE x ARO, giving $2,500 of expected annual loss. ALE is not a forecast of any real incident; it is the yearly toll you should be willing to pay to shrink the chance or size of that incident.
Weighing Control Cost Against Exposure
A control earns its keep by cutting ALE. If a $400/year backup-and-endpoint package drops the example above from ALE $2,500 to $500, it removes $2,000 of expected loss for $400 -- clearly worth buying. If the same benefit requires a $3,000 product, you are overpaying relative to exposure; right-size instead, and remember the control's own ongoing costs: subscriptions, labor, and training all belong in the balance. Two guardrails keep beginners honest: never spend more per year than the exposure you are removing without an explicit reason (compliance, reputation, contracts), and prefer controls that also kill neighboring register rows, because shared cost is free leverage.
The Four Treatment Options
Every scored risk ends in one of four verbs. Mitigate: deploy controls to cut likelihood or impact. Accept: a named owner signs off that the exposure is tolerable, with a review date attached. Transfer: insurance, contracts, or an outsourced provider shift part of the financial impact -- never the accountability. Avoid: stop the activity entirely, like retiring the legacy service instead of hardening it. The honest answer is often a mixture, such as mitigate down to appetite and accept the remainder.
Architecture Diagram
Key Takeaways
- SLE = Asset Value x Exposure Factor; ARO = expected events per year; ALE = SLE x ARO.
- ALE is an annual budget signal, not a prediction of any single incident.
- Buy the control when the ALE it removes exceeds its total annual cost, labor included.
- Treatment is one of four verbs: mitigate, accept (with a signed owner), transfer, or avoid.
- Transfer moves financial impact, never accountability; combinations of the four are normal.