Security+
CompTIA Security+ SY0-801 / All lessons / Domain 5.0: Security Program Management and Oversight
5Domain 5.0: Security Program Management and Oversight
Security+ topic 5.2

Risk Management

Risk management finds, measures, and treats risk. Risk assessments can be qualitative (high, medium, low) or quantitative (in dollars). The quantitative formulas are: single loss expectancy (SLE) equals asset value times exposure factor, and annualized loss expectancy (ALE) equals SLE times the annualized rate of occurrence (ARO). A risk register lists risks, owners and key risk indicators. Risk is treated four ways: transfer it (insurance), accept it, avoid it (stop the activity), or mitigate it (add controls). Risk appetite and tolerance describe how much risk leaders will take. A business impact analysis sets the recovery time objective (RTO) and recovery point objective (RPO).

Picture itAsset value$50,000 ×Exposure40% =SLE$20,000 ARO0.2 / yr →ALE = $20,000 × 0.2$4,000 per year
Quantitative risk: SLE = asset value × exposure factor. ALE = SLE × ARO.

Risk Management vocabulary

  • Annualized loss expectancy (ALE): Expected yearly loss from a risk: SLE multiplied by ARO.
  • Risk register: A list of identified risks with their owners, ratings, and responses.
  • Risk transference: Shifting the cost of a risk to someone else, such as an insurer.
  • Recovery time objective (RTO): The longest a system can be down before the impact is unacceptable.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

A server is worth $50,000. A flood would damage 40% of it. Floods happen about once every 5 years.

1. What is the annualized loss expectancy (ALE)?

  1. (A) $4,000
  2. (B) $10,000
  3. (C) $20,000
  4. (D) $100,000
Show answer

(A) $4,000 SLE = $50,000 × 0.4 = $20,000. ARO = 1/5 = 0.2. ALE = $20,000 × 0.2 = $4,000.

2. A company buys cyber insurance to cover the cost of a data breach. Which risk response is this?

  1. (A) Acceptance
  2. (B) Avoidance
  3. (C) Transference
  4. (D) Mitigation
Show answer

(C) Transference Shifting the cost of a risk to an insurer is transference.

3. A company stops offering an old service because its risk is too high to manage. Which risk response is this?

  1. (A) Avoidance
  2. (B) Transference
  3. (C) Acceptance
  4. (D) Mitigation
Show answer

(A) Avoidance Ending the risky activity avoids the risk.

4. A business impact analysis finds that the order system can be down for no more than 4 hours. Which of the following metrics is this?

  1. (A) RPO
  2. (B) RTO
  3. (C) MTBF
  4. (D) ARO
Show answer

(B) RTO The maximum acceptable downtime is the recovery time objective.

Open 5.2 in the interactive course