Question

An information security manager must recommend which of two risk scenarios to address first. Scenario 1 has a single loss expectancy (SLE) of $50,000 and an annual rate of occurrence (ARO) of 3. Scenario 2 has an SLE of $250,000 and an ARO of 0.5. Mitigation for each costs approximately $80,000 per year. Which scenario should be prioritized for treatment based on cost-effectiveness?

Accepted Answer

Scenario 1, because its annualized loss expectancy exceeds the cost of the control

Answer

Scenario 2, because its single loss expectancy is the highest and represents catastrophic loss

Answer

Scenario 2, because a lower rate of occurrence indicates the control will be more effective

Answer

Neither, because both mitigation costs exceed their annualized loss expectancy