Risk Parameters
Control ROSI Analysis (optional)
Evaluate whether a proposed control is financially worth implementing.
How it works
This calculator turns a security or resilience risk into an annualised dollar figure using the classic quantitative model taught in the NIST SP 800-30 and CISSP risk bodies of knowledge. Instead of a vague "high / medium / low" rating, you express one loss scenario as three numbers and let the arithmetic do the rest. It answers two questions a board actually asks: how much does this risk cost us per year, and is the control we are proposing worth the spend?
Three inputs define the exposure:
- Asset Value (AV): the full replacement or impact value of the asset at stake, in dollars. Include recovery cost, lost revenue, and regulatory or reputational impact, not just the book value of hardware.
- Exposure Factor (EF), the percentage of that asset value you would lose in a single incident. A total loss is 100%; a partial outage or partial data loss is lower.
- Annual Rate of Occurrence (ARO), how many times per year you expect the event. Use decimals for rare events: 0.25 means once every four years, 2 means twice a year.
The optional control analysis adds two more: the Annual Cost of Control (the fully-loaded yearly cost of the mitigation) and Control Effectiveness (the percentage of the risk it removes). From these the tool derives Single Loss Expectancy, Annual Loss Expectancy, and Return on Security Investment:
ALE = SLE × ARO
ALE‑after = ALE × (1 − Effectiveness / 100)
Benefit = ALE − ALE‑after
ROSI% = ((Benefit − Cost) / Cost) × 100
A control is flagged cost-justified when the annual Benefit exceeds the annual Cost, i.e. when ROSI is positive.
Worked example. A customer database is valued at $500,000 (AV). A ransomware event is judged to destroy 40% of that value (EF), and you expect it once every four years (ARO = 0.25). Then SLE = 500,000 × 0.40 = $200,000 and ALE = 200,000 × 0.25 = $50,000 per year. Now propose an immutable-backup control costing $25,000/yr that removes 70% of the risk: ALE‑after = 50,000 × 0.30 = $15,000, so the Benefit is $35,000/yr and ROSI = ((35,000 − 25,000) / 25,000) × 100 = 40%. Benefit beats cost, so the control is cost-justified.
Benchmarks & reference points
The values below are definitional or mathematically derivable, offered as anchors when you are estimating inputs. Treat any range as typical and illustrative, not a substitute for figures from your own environment.
| Reference | Definition / value |
|---|---|
| SLE | Single Loss Expectancy = AV × EF (dollars lost in one event) |
| ALE | Annual Loss Expectancy = SLE × ARO (dollars lost per year) |
| ARO = 0.1 | Once in 10 years (rare) |
| ARO = 0.25 | Once in 4 years |
| ARO = 1 | Once per year |
| ARO = 12 | Once per month |
| EF interpretation | 100% = total loss; 50% = half of asset value impaired; lower = partial impact |
| ROSI break-even | Benefit = Cost → ROSI = 0% (above zero is cost-justified) |
| Availability | MTBF / (MTBF + MTTR), pairs with ALE for resilience cases |
| 99.9% uptime ("three nines") | ≈ 8h 46m allowed downtime per year |
| 99.99% uptime ("four nines") | ≈ 52m 34s allowed downtime per year |
SLA "nines" convert to allowed downtime by exact arithmetic: 0.001 × 8,760 hours ≈ 8.76 hours for three nines. Use those figures to sanity-check the Exposure Factor for an availability-driven scenario.
Using this in the boardroom
ALE is the number that belongs on the slide; SLE, EF, and ARO are the working that belongs in the appendix. Boards think in annual budgets, so a single "$50,000/yr expected loss from this risk" line lets non-technical directors compare a security exposure against any other operating cost. Present the ALE alongside the ROSI for the proposed control, and you have reframed a request for money as a risk-reduction transaction: "we spend $25k to remove $35k of expected annual loss."
Pair the figure with the assumptions that produced it and with at least one sensitivity view, show the ALE at a pessimistic and optimistic ARO so the board sees the range, not a false-precision point estimate. Common pitfalls: treating a single point estimate as fact, double-counting the same loss across scenarios, ignoring low-frequency / high-impact "tail" events that a mean ALE understates, and using replacement cost for AV when the real driver is downtime or regulatory penalty.
Key takeaway
The precise dollar figure matters less than the discipline it forces. Making AV, EF, and ARO explicit turns an argument about opinions into a conversation about assumptions, and assumptions can be challenged, refined, and defended in front of a board.
Frequently asked questions
What is the difference between SLE and ALE?
SLE (Single Loss Expectancy) is the dollar loss from one occurrence of the event, asset value multiplied by the exposure factor. ALE (Annual Loss Expectancy) scales that up by how often you expect the event in a year (ARO). A severe but rare event can have a large SLE yet a modest ALE, which is exactly why you annualise before comparing risks.
How do I estimate the Annual Rate of Occurrence when I have no history?
Use a frequency you can defend and express it as a decimal: once in five years is 0.2, twice a year is 2. Anchor to industry incident reports, insurer loss data, or the frequency of near-misses in your own environment. Because ARO is the most uncertain input, always run the calculation at a low and high estimate to see how sensitive the ALE is.
What counts as a good ROSI?
Any positive ROSI means the control returns more in avoided loss than it costs, so it is financially rational in isolation. In practice you rank controls by ROSI and fund the highest-return mitigations first, subject to budget. A ROSI near zero signals a marginal control that may be worth deferring in favour of a stronger one.
Is quantitative risk analysis better than a qualitative heat map?
They answer different questions. A heat map is fast and good for triage across many risks; the ALE model is slower but produces a dollar figure a CFO and board can act on. Most mature programs use qualitative screening to shortlist risks, then quantify the few that justify real investment decisions.
Should ALE be my security budget?
No. ALE is the expected annual loss from one modelled scenario, not a spending target. It informs how much a specific control is worth - you would rarely spend more per year than the risk you remove - but budgets also cover controls that reduce many risks at once, compliance obligations, and low-frequency tail events the mean understates.