Annualized loss expectancy (ALE) estimates the financial loss an organization expects from a specific risk or threat over one year. It turns an asset’s potential loss and the expected frequency of incidents into a yearly figure. section 6.3.2
ALE = Single loss expectancy (SLE) x Annual rate of occurrence (ARO)
ALE equals single loss expectancy (SLE) multiplied by annual rate of occurrence (ARO). SLE is asset value multiplied by exposure factor (EF); ARO is the number of incidents per year. section 6.3.2
Estimate the exposure factor
For a stolen encrypted laptop, an EF of 10% may be more appropriate than 100% because encryption prevents data exposure. Check that assumption before using it in the yearly estimate: an inaccurate EF can understate or overstate the loss. section 6.3.2
