Security Program Management and Oversight · Topic 2 of 7
Risk Assessment and Analysis
Security+ risk assessment: qualitative and quantitative analysis, SLE, ALE and ARO formulas with worked examples, risk registers, appetite and tolerance.
- 4 min
- SLE = AV x EF, and ALE = SLE x ARO.
- Qualitative analysis ranks risks with scales. Quantitative analysis assigns money values.
- Exposure factor is the percentage of value lost in one event.
What it is
Risk is the chance that a threat will exploit a weakness and cause a loss. Risk management is the process of finding risks, measuring them and deciding what to do about them.
This page covers identification, assessment and analysis, including the quantitative formulas that the exam tests directly.
How it works
Identification and assessment
Risk identification finds what could go wrong, using asset lists, threat information, vulnerability scans and past incidents. Assessment then rates each risk. Assessments can be run in different ways.
| Type | Meaning |
|---|---|
| Ad hoc | Done when a need arises, such as before a new project |
| Recurring | Repeated on a schedule, such as every year |
| One time | A single assessment for a specific purpose |
| Continuous | Ongoing, often with automated tools |
Qualitative and quantitative analysis
| Approach | Method | Result |
|---|---|---|
| Qualitative | Uses judgment and scales such as low, medium and high | A ranking of risks |
| Quantitative | Uses numbers, usually money | A cost estimate for each risk |
Qualitative analysis is faster and easier but less exact. Quantitative analysis supports cost benefit decisions, but it needs reliable data.
Quantitative formulas
| Term | Meaning |
|---|---|
| Asset value (AV) | What the asset is worth |
| Exposure factor (EF) | The percentage of the asset's value lost in one event |
| Single loss expectancy (SLE) | The expected loss from one event: SLE = AV x EF |
| Annualized rate of occurrence (ARO) | How many times per year the event is expected |
| Annualized loss expectancy (ALE) | The expected loss per year: ALE = SLE x ARO |
Worked example. A server is worth 200,000 and a failure would destroy 25 percent of its value, so the SLE is 50,000. If the failure is expected once every two years, the ARO is 0.5, and the ALE is 25,000.
A control is worth buying if its yearly cost is less than the loss it prevents. If a control costs 10,000 a year and cuts the ALE from 25,000 to 5,000, the saving of 20,000 is greater than the cost.
Probability, likelihood and impact
Probability is the mathematical chance of an event. Likelihood is a more general sense of how probable it is, and is often rated on a scale.
Impact is the damage if the event happens. Together they give a risk rating.
Risk register
A risk register is a record of identified risks. Entries usually include a description, an owner, a likelihood and impact rating, planned response and status.
Key risk indicators (KRIs) are measures that warn when risk is rising. The register is reviewed regularly and reported to management.
Risk tolerance and appetite
| Term | Meaning |
|---|---|
| Risk appetite | The amount and type of risk the organization is willing to pursue to reach its goals |
| Risk tolerance | How far results may vary from the target before action is needed |
| Risk threshold | The point at which a risk must be treated |
Appetite can be described as expansionary (willing to take more risk for growth), conservative (avoid risk) or neutral. Appetite is the broad stance, and tolerance is the acceptable variation around it.
Inherent and residual risk
Inherent risk is the risk before any controls. Residual risk is what remains after controls are applied. Management decides whether the residual risk is acceptable.
What to remember for the exam
- SLE = AV x EF, and ALE = SLE x ARO.
- Qualitative analysis ranks risks with scales. Quantitative analysis assigns money values.
- Exposure factor is the percentage of value lost in one event.
- ARO is the number of expected events per year, and can be a fraction.
- A risk register lists risks with owners, ratings and responses.
- Risk appetite is the broad willingness to take risk, and tolerance is the acceptable variation.
- Residual risk is what remains after controls.
- A control is cost effective if it costs less than the loss it prevents.
In a formula question, write the numbers in order: find SLE first, then multiply by ARO to get ALE.
Common mistakes
Confusing SLE and ALE. SLE is the loss from one event. ALE is the loss expected over a year.
Entering the exposure factor as a whole number. Use 25 percent as 0.25 when you multiply.
Mixing up appetite and tolerance. Appetite is the overall amount of risk the organization will take, while tolerance is the allowed variation.
Assuming controls remove all risk. Some residual risk usually remains.
Treating a qualitative rating as exact. A rating of "high" is a judgment, not a measurement.
Quantitative figures are only as good as the inputs. Weak estimates of asset value or frequency give weak results.
Check yourself
How is the annualized loss expectancy calculated?
ALE equals the single loss expectancy multiplied by the annualized rate of occurrence.
What is the SLE if an asset worth 100,000 would lose 40 percent of its value in an incident?
40,000, because 100,000 multiplied by 0.40 is 40,000.
What is residual risk?
The risk that remains after controls have been applied.
Topic 2 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.