Annualized Loss Expectancy (ALE) estimates the money a specific threat is expected to cost over a single year. It is calculated by multiplying the Single Loss Expectancy (SLE), the dollar impact of one occurrence, by the Annualized Rate of Occurrence (ARO), how many times that event is expected to happen each year.
Suppose a server failure costs $100,000 to recover from and is expected twice annually. The SLE is $100,000, the ARO is 2, and the ALE works out to $200,000. That figure becomes the yardstick for a safeguard: if a control costs less than $200,000 a year and meaningfully cuts the likelihood, it likely pays for itself. The honest caveat is that ALE is only as sound as the ARO estimate, and for rare, high-impact events those frequencies are little more than educated guesses dressed up as precise numbers.
Why does ALE matter for the CISSP exam?
ALE is central to quantitative risk analysis in Domain 1: Security and Risk Management. Candidates must know the full SLE and ARO calculation, use ALE to weigh controls against their cost, and recognize the limits of putting dollar figures on uncertain risk.