What is ALE, ARO, SLE.?

Quantitative Risk Assessment

Quantitative assessment deals with numbers and dollar amounts. It attempts to assign a cost (monetary value) to the elements of risk assessment and to the assets and threats of a risk analysis.

To fully complete a quantitative risk assessment, all elements of the process (asset value, impact, threat frequency, safeguard effectiveness, safeguard costs, uncertainty, and probability) are quantified. Therein lies the problem with purely quantitative risk assessment: It is difficult, if not impossible, to assign dollar values to all elements; therefore, some qualitative measures must be applied to quantitative elements. A quantitative assessment requires substantial time and personnel resources. The quantitative assessment process involves the following three steps:

  1. Estimate potential losses (SLE)
  2. Conduct a threat analysis (ARO)
  3. Determine annual loss expectancy (ALE)

Continue reading “What is ALE, ARO, SLE.?”

Annual loss expectancy (ALE)

The expected value (cost) of a yearly occurrence of incidents of given type, in monetary units. It is a product of SLE and ARO (SLE*ARO). The ALE for each type of incident is different.


Annual rate of occurrence (ARO)

Expected number of an incident’s occurrences during a calendar year. For rare incidents, it is equivalent to a probability of one or more incidents during a year; for frequent incidents, it is equivalent to the expected number of incidents per year. The ARO for each type of incidents is different.

Gross margin

The difference between revenue and cost before accounting for certain other costs. Generally, it is calculated as the total selling price of the items sold (revenue), less the cost of goods sold (production or acquisition costs).


The term here used for all costs borne by the entity besides the personnel costs.

Revenue (also called turnover)

The annual sum of all net invoices issued by a company, i.e. the total net price (without VAT) of all products sold during the fiscal year.

Single loss of expectancy (SLE)

The expected value (cost) of an incident in monetary units, assuming its single occurrence. The SLE for each type of incidents is different.

Total ALE (TALE)

The total expected annual loss expectancy from all types of incidents considered.

What is RTO, RPO, WRT, MTD ?

When it comes to Disaster Recovery & High Availability Techniques, these Acronyms are a must. So will discuss a bit in further.

1. Business as usual


At this stage all systems are running production and working correctly.

2. Disaster occurs


On a given point in time, disaster occurs and systems needs to be recovered. At this point the Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time.

Continue reading “What is RTO, RPO, WRT, MTD ?”

3. Recovery


At this stage the system are recovered and back online but not ready for production yet. The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online.

4. Resume Production


At this stage all systems are recovered, integrity of the system or data is verified and all critical systems can resume normal operations. The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available.

5. Resume Production – Scenario


The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences.