A calculation that simply compares the Annual Loss Expectancy against the expected savings from implementing a given control.

A calculation that simply compares the Annual Loss Expectancy against the expected savings from implementing a given control.

• A. Payback
• B. Return on Investment (ROI)
• C. Magnitude of Impact
• D. Compensative Control

Answer: (B)

This looks at the value of a security control by weighing how much loss you avoid each year against what you spend on the control. In risk terms, ALE (annual loss expectancy) is the expected yearly cost from a threat without the control, and the savings from the control are the yearly benefits you gain by reducing that risk. The measurement that captures how much you gain per unit of money spent is return on investment. ROI is essentially the ratio of the benefit (the savings) to the cost of the control, indicating whether you’re getting a worthwhile return. If the savings outweigh the cost, ROI is positive, meaning the investment makes sense; if not, it’s not worthwhile. Payback would focus on how long it takes to recover the initial outlay, which is a different calculation; magnitude of impact isn’t a calculation, and a compensative control is a type of control, not a metric.

This looks at the value of a security control by weighing how much loss you avoid each year against what you spend on the control. In risk terms, ALE (annual loss expectancy) is the expected yearly cost from a threat without the control, and the savings from the control are the yearly benefits you gain by reducing that risk. The measurement that captures how much you gain per unit of money spent is return on investment. ROI is essentially the ratio of the benefit (the savings) to the cost of the control, indicating whether you’re getting a worthwhile return. If the savings outweigh the cost, ROI is positive, meaning the investment makes sense; if not, it’s not worthwhile.

Payback would focus on how long it takes to recover the initial outlay, which is a different calculation; magnitude of impact isn’t a calculation, and a compensative control is a type of control, not a metric.