An enterprise risk analyst is conducting a quantitative risk assessment for a Payment Card… — CompTIA Security+

An enterprise risk analyst is conducting a quantitative risk assessment for a Payment Card Industry (PCI) transaction processing gateway. The asset value ( $AV$ ) of the server cluster is $\$600,000$ . Threat intelligence estimates an Annualized Rate of Occurrence ( $ARO$ ) of $0.40$ for a severe security breach, with an unmitigated Exposure Factor ( $EF$ ) of $30\%$ .

To mitigate this risk, the organization deploys a continuous security monitoring and automated data protection control costing $\$15,000$ annually. This control reduces the Exposure Factor ( $EF$ ) to $5\%$ while the $ARO$ remains unchanged.

What is the net annual financial benefit (in USD) of implementing this security control?

Answer: 45000 USD

Answer

The net annual financial benefit of implementing the security control is $45,000 USD.

The initial Annualized Loss Expectancy (

ALE_{initial}

) is calculated as

AV \times EF \times ARO = \$600,000 \times 0.30 \times 0.40 = \$72,000

. After implementing the control, the new

ALE

\$600,000 \times 0.05 \times 0.40 = \$12,000

. The risk mitigation yields a gross annual reduction in loss of

\$60,000

. Subtracting the safeguard's annual cost of

\$15,000

yields a net annual financial benefit of

\$45,000

Step-by-Step Solution

Calculate initial Annualized Loss Expectancy (ALE)

ALE_{initial} = \$600,000 \times 0.30 \times 0.40 = \$72,000

Determines total expected financial loss per year before implementing the safeguard.

Calculate post-control Annualized Loss Expectancy (ALE)

ALE_{mitigated} = \$600,000 \times 0.05 \times 0.40 = \$12,000

Determines expected financial loss per year after the safeguard reduces exposure.

Compute net annual financial benefit

Net\ Benefit = (\$72,000 - \$12,000) - \$15,000 = \$45,000

Subtracts the annual cost of the safeguard from the gross annual loss reduction to find net savings.

Key Concept

Quantitative Risk Analysis & Cost-Benefit Calculation (ALE and Safeguard ROI)

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic