An asset worth $200,000 loses 25% of its value in a single fire. What is the SLE?

$50,000 (SLE = AV x EF = 200,000 x 0.25)

SLE is $50,000 and the event is expected once every 4 years. What is the ALE?

$12,500 (ALE = SLE x ARO = 50,000 x 0.25)

A control cutting ALE from $40,000 to $10,000 costs $18,000 per year. What is its net annual value?

$12,000 ((40,000 - 10,000) - 18,000)

What does the Exposure Factor (EF) represent?

The percentage of an asset's value lost in a single incident

Which value can be a fraction less than 1?

ARO - e.g., once every 10 years = 0.1

When is a safeguard financially justified in CISSP terms?

A safeguard is justified when the annual ALE reduction it produces is greater than its annual cost. Value of the control = (ALE before - ALE after) - annual cost of the control. If that number is positive, the control saves more than it costs; if negative, you are overspending relative to the risk.

SLE vs ALE vs ARO: How to Calculate CISSP Risk (With Worked Examples)

Q: What is the difference between SLE and ALE on the CISSP exam?

SLE (Single Loss Expectancy) is the dollar loss from one occurrence of a threat: SLE = Asset Value x Exposure Factor. ALE (Annualized Loss Expectancy) is the expected loss per year: ALE = SLE x ARO. SLE is per-incident; ALE is annual. The exam frequently gives you AV, EF, and ARO and asks for one specific value, so read carefully which one is being requested.

Q: How do you calculate ALE?

ALE = SLE x ARO, and SLE = AV x EF. So ALE = Asset Value x Exposure Factor x Annualized Rate of Occurrence. Example: a $100,000 server, 40% destroyed by a flood (EF 0.4) that happens once per 10 years (ARO 0.1) gives SLE = $40,000 and ALE = $4,000 per year.

Q: Can ARO be greater than 1 or less than 1?

Yes. ARO is the number of times an event is expected per year. It is greater than 1 for frequent events (e.g., 12 phishing incidents a year = ARO 12) and a fraction below 1 for rare events (e.g., once every 5 years = 0.2, once every 10 years = 0.1). Converting 'once every N years' into 1/N is one of the most tested steps.

The quantitative risk formulas are some of the few questions on the CISSP where the answer is a single, checkable number - which means they are free points once the math clicks. The problem is that the acronyms (AV, EF, SLE, ARO, ALE) look interchangeable and the exam deliberately hands you extra values to see if you pick the right one. This guide walks the whole chain, AV to EF to SLE to ARO to ALE, with worked examples and the safeguard cost-benefit calculation that follows it.

By Moussa BENALI · Updated July 2026 · 9 min read

Moussa BENALI

Senior Network & Security Engineer · I run quantitative risk analysis on real budgets, not just for exam questions. I built FigigExams to give candidates concept-level feedback instead of just a score.

Written for CISSP Domain 1 · Jul 2026

Free full exam · no credit card

Test yourself on real CISSP risk questions

Take a full-length CISSP practice exam free - risk math and all eight domains, with an Explanation and an Exam Tip on every item and a personalized Exam Coach when you finish. Create an account on the next screen and the code auto-applies.

CISSP-EXAM-FULL Start the free exam

Already have an account? Log in to start

In This Guide

The five terms (AV, EF, SLE, ARO, ALE)
The two formulas you must memorize
Worked example 1: the flooded server room
Worked example 2: stolen laptops
Is the safeguard worth it? (cost-benefit)
Exam traps that cost people points
Practice Questions (5 Free)
FAQ

The five terms, in the order the math flows

Every quantitative risk question is built from the same five values. The trick is that they chain: each one feeds the next. Learn them in this order and the formulas stop being something to memorize and start being obvious.

Term	Means	Unit	Plain-language
AV - Asset Value	What the asset is worth	$ dollars	Replacement or book value of the thing at risk
EF - Exposure Factor	% of the asset lost in one event	% or 0-1	How much of it a single incident destroys
SLE - Single Loss Expectancy	Dollar loss from one event	$ dollars	What one incident costs you
ARO - Annualized Rate of Occurrence	How many times per year	count / year	Frequency - can be 12, or 0.1
ALE - Annualized Loss Expectancy	Expected loss per year	$ / year	The number you budget against

⚡

The one distinction the exam tests most: SLE is per incident, ALE is per year. If a question says "each time" or "per event," it wants SLE. If it says "annual," "per year," or "budget," it wants ALE. Choosing the wrong one is the single most common way people lose these points.

The two formulas you must memorize

That is genuinely all of it. Two equations, and the second is built from the first.

📐

SLE = AV × EF (single loss = asset value × exposure factor)
ALE = SLE × ARO (annual loss = single loss × how often per year)
Combined: ALE = AV × EF × ARO

A quick sanity check for EF: it is a percentage, never a dollar figure. If a total loss occurs (the asset is destroyed), EF = 1.0 (100%). If half is lost, EF = 0.5. When a question gives you a dollar loss directly, that dollar figure is already the SLE - you do not multiply it by EF again.

Worked example 1: the flooded server room

A storage array in the data center is valued at $100,000. Regional flood history says a flood severe enough to reach the racks happens roughly once every 10 years, and such a flood would destroy about 40% of the array before it could be shut down and moved.

Step by step

AV  = $100,000            (asset value)
EF  = 0.40                (40% destroyed in one flood)
SLE = AV × EF
    = $100,000 × 0.40
    = $40,000             (cost of ONE flood)

ARO = 1 / 10 = 0.10       ("once every 10 years")
ALE = SLE × ARO
    = $40,000 × 0.10
    = $4,000  per year    (what you budget annually)

💡

The conversion step: "once every 10 years" is not ARO = 10. It is ARO = 1/10 = 0.10. Turning "once every N years" into 1/N is where a large share of wrong answers come from. Frequent events flip the other way: "12 times a year" is simply ARO = 12.

Worked example 2: stolen laptops

Now a case where the event happens many times a year and the loss is total. Each corporate laptop is worth $2,000. When one is stolen it is a complete loss, and last year 3 laptops were stolen across the company.

Step by step

AV  = $2,000
EF  = 1.0                 (theft = total loss, 100%)
SLE = $2,000 × 1.0 = $2,000

ARO = 3                   (3 thefts per year)
ALE = $2,000 × 3 = $6,000  per year

Notice the shape is identical - only the numbers change. When EF is 100%, SLE simply equals AV, and the whole question becomes "value × frequency." Recognizing that shape quickly is what lets you answer these in under a minute on exam day.

Is the safeguard worth it? The cost-benefit calculation

The formulas above rarely stand alone. The exam's favorite follow-up is: you can buy a control that reduces the risk - should you? Quantitative risk analysis answers that with one comparison.

📐

Value of a safeguard = (ALE before − ALE after) − annual cost of the safeguard
If the result is positive, the control saves more than it costs. If negative, you are spending more than the risk is worth.

Back to the flooded server room. Its ALE is $4,000/year. A set of flood barriers and raised racking would cut the exposure factor from 0.40 to 0.10, and costs $1,000/year to maintain.

Does the control pay for itself?

Before:  ALE = $100,000 × 0.40 × 0.10 = $4,000 / year
After:   ALE = $100,000 × 0.10 × 0.10 = $1,000 / year

ALE reduction         = $4,000 − $1,000 = $3,000 / year
Annual cost of control                  = $1,000 / year
Net value of control  = $3,000 − $1,000 = $2,000 / year  ✅ worth it

The control produces $3,000 of avoided loss per year and costs $1,000, so it nets $2,000 a year. If those flood barriers had instead cost $3,500/year, the net value would be negative ($3,000 − $3,500 = −$500) and a CISSP-level answer is do not buy it - you would be spending more to avoid the loss than the loss is expected to cost. Risk is a budget, not a moral crusade.

⚠️

Watch the cost side. "Cost of the safeguard" means its annualized cost of ownership - purchase amortized over its life, plus maintenance, staffing, and productivity impact - not just the sticker price. A control that is cheap to buy but expensive to operate can still fail the test.

Exam traps that cost people points

SLE vs ALE mix-up. The question gives you everything for ALE but asks for SLE (or vice versa). Underline which one is requested before you compute.
"Once every N years." That is ARO = 1/N, a fraction below 1 - not N.
EF given as dollars. EF is always a percentage. If the scenario hands you a dollar loss per incident, that is already the SLE.
Extra numbers on purpose. You may be given AV, EF, ARO, and a control cost when the question only needs two of them. Pull only what the formula requires.
Quantitative vs qualitative. These formulas are quantitative (hard dollar figures). If a scenario has no reliable numbers and relies on High/Medium/Low ratings or a risk matrix, that is qualitative analysis, and SLE/ALE do not apply.
The purpose question. Sometimes it is not math at all: "What is ALE used for?" The answer is to justify safeguard spending and prioritize risk - to compare the annual cost of a control against the annual loss it prevents.

Free full exam · no credit card

See these as real exam items

Risk math is easy to follow on a page and easy to fumble under time pressure. Take a free CISSP practice exam and get a concept-level breakdown of where your points actually leak.

CISSP-EXAM-FULL Start the free exam

Prefer to drill the acronyms first? Free interactive CISSP flashcards →

CISSP Risk-Math Practice Questions

Five expert-written questions in the exact style the CISSP uses. Each has a full explanation, so a wrong answer still teaches you something.

Ready for More?

You've locked in the risk formulas. Here's how to keep building toward exam day:

📝

Free CISSP Practice Exam

All 8 domains · Explanation + Exam Tip per item · Personalized Coach

Start Exam → 🔐

CISSP Security Models

Biba vs Bell-LaPadula vs Clark-Wilson, explained plainly

Read Now →

Frequently Asked Questions

What is the difference between SLE and ALE on the CISSP exam?

SLE (Single Loss Expectancy) is the dollar loss from one occurrence: SLE = AV × EF. ALE (Annualized Loss Expectancy) is the expected loss per year: ALE = SLE × ARO. SLE is per-incident; ALE is annual. The exam often gives you AV, EF, and ARO together and asks for just one, so confirm which is being requested before you calculate.

How do you calculate ALE?

ALE = SLE × ARO, and SLE = AV × EF, so ALE = AV × EF × ARO. Example: a $100,000 server, 40% destroyed by a flood (EF 0.4) that occurs once per 10 years (ARO 0.1) gives SLE = $40,000 and ALE = $4,000 per year.

Can ARO be greater than 1 or less than 1?

Yes. ARO is how many times per year an event is expected. It is above 1 for frequent events (12 incidents a year = 12) and a fraction below 1 for rare events (once every 5 years = 0.2, once every 10 years = 0.1). Converting "once every N years" to 1/N is heavily tested.

When is a safeguard financially justified?

When the annual ALE reduction exceeds the annual cost of the control. Value of the control = (ALE before − ALE after) − annual cost. Positive means it saves more than it costs; negative means you are overspending relative to the risk.

Is SLE/ALE quantitative or qualitative risk analysis?

Quantitative - it produces hard dollar figures from asset values and probabilities. Qualitative analysis uses relative ratings (High/Medium/Low) and risk matrices when reliable numbers are not available. CISSP tests both and expects you to tell them apart.