Quantitative risk analysis uses mathematical formulas to calculate expected loss. The core formula chain: AV × EF = SLE. SLE × ARO = ALE. ALE drives security investment decisions.
The CISSP exam tests quantitative risk calculations directly — you will likely see a scenario question requiring you to calculate SLE, ALE, or cost-benefit analysis.
AV (Asset Value): The monetary value of the asset.
EF (Exposure Factor): The percentage of asset value lost in a single incident (as a decimal, e.g., 0.60).
SLE (Single Loss Expectancy): AV × EF. The expected monetary loss from a single occurrence.
ARO (Annual Rate of Occurrence): How many times per year the threat is expected to occur.
ALE (Annual Loss Expectancy): SLE × ARO. The expected total annual loss.
The decision rule: implement a control if its cost is less than the risk reduction it provides.
ALE (before) − ALE (after) − Annual Cost of Control = Value of the Safeguard
If the value is positive, the control is worth implementing.
Quantitative: Uses numbers — ALE, SLE, ARO. Objective, defensible to management, enables cost-benefit analysis.
Qualitative: Uses subjective ratings — High/Medium/Low. Faster, easier, useful when data is scarce.
Quantitative risk formulas
| Term | Formula | Meaning |
|---|---|---|
| AV | — | Asset Value in dollars |
| EF | — | % of asset destroyed in one incident (0.0–1.0) |
| SLE | AV × EF | Loss from a single incident |
| ARO | — | Expected frequency per year |
| ALE | SLE × ARO | Expected annual loss from this threat |
| Safeguard Value | ALE(before) − ALE(after) − Control Cost | Net benefit of implementing a control |