CISSP Practice Question – Risk Management

An organization is conducting a risk assessment and has identified several threats to its critical customer database. After calculating both the Annual Rate of Occurrence (ARO) and the Single Loss Expectancy (SLE), management now wants to determine the total expected loss per year.

Which of the following should be calculated NEXT?

A. Exposure Factor (EF)

B. Annual Loss Expectancy (ALE)

C. Residual Risk

D. Total Cost of Ownership (TCO)

16 comments