Risk Management Explained: SLE, ALE, RTO and the Four Responses (Security+)
What you’ll know
How to put a dollar figure on a risk, the four ways to respond to one, what RTO and RPO mean for backups and outages, and the policies, frameworks and contracts that tie it together.
Why it matters. Security+ isn’t only firewalls and logs: a whole domain is about deciding which risks are worth paying to fix. It’s also how you win the argument for a budget, by showing the control costs less than the loss it prevents.
Put a number on it
| Term | Means | Formula |
|---|---|---|
| AV | Asset value: what the thing is worth, including the cost of losing its data | |
| EF | Exposure factor: the share of the value lost in one incident (0 to 100%) | |
| SLE | Single loss expectancy: the cost of one incident | SLE = AV × EF |
| ARO | Annualized rate of occurrence: how many times a year you expect it (0.2 = once every 5 years) | |
| ALE | Annualized loss expectancy: the expected cost per year | ALE = SLE × ARO |
If a control costs less per year than the ALE it removes, it pays for itself.
The four responses
| Response | Means | Example |
|---|---|---|
| Mitigate (reduce) | Add a control to make it less likely or less damaging | Full-disk encryption, MFA, patching |
| Transfer (share) | Make someone else carry the cost | Cyber insurance, a contract that makes a vendor liable |
| Avoid | Stop doing the risky thing | Stop storing card numbers at all |
| Accept | Live with it, on purpose and in writing | A low-value risk that costs more to fix than to suffer |
Whatever is left after your controls is residual risk. How much risk an organization is willing to live with is its risk appetite, and risks are tracked in a risk register.
Outages and backups: RTO, RPO, MTTR, MTBF
| Term | Question it answers |
|---|---|
| RTO (recovery time objective) | How long can we be down before it really hurts? |
| RPO (recovery point objective) | How much data can we afford to lose? (A 4-hour RPO needs a backup at least every 4 hours.) |
| MTTR (mean time to repair) | On average, how long does a fix take? |
| MTBF (mean time between failures) | On average, how long does it run before it breaks? |
Policies, frameworks and contracts
- Policies set the rules: acceptable use (AUP), passwords, incident response, data handling. Standards and procedures say exactly how.
- Frameworks give a ready-made structure: NIST Cybersecurity Framework, ISO/IEC 27001, CIS Controls.
- Data roles: the owner decides how data is used and classified; the custodian looks after it day to day; under privacy laws the controller decides why data is processed and the processor handles it on their behalf.
- Vendor agreements: SLA (service levels and penalties), NDA (keep secrets), MOU (an agreement of intent), MSA (the master contract other deals sit under), plus right-to-audit clauses.
Steven’s risk response for the coffee machine is “accept”. Nova’s is “mitigate, with a second coffee machine.” That’s called redundancy, and yes, it’s on the exam. — Nyx
Try it: a risk calculator
Save this as risk.py. A laptop is stolen about once every five years; losing it costs the hardware plus a customer-data breach. Encrypting the drive means a thief gets only the hardware:
# risk.py: single loss expectancy (SLE) and annualized loss expectancy (ALE)
asset_value = 15000 # AV: a $1,500 laptop + about $13,500 to handle a customer-data breach
exposure_factor = 1.0 # EF: share of that value lost per theft (1.0 = all of it)
aro = 0.2 # ARO: expected thefts per year (one every 5 years)
sle = asset_value * exposure_factor
ale = sle * aro
print(f"SLE = ${sle:,.0f} per incident")
print(f"ALE = ${ale:,.0f} per year")
control_cost = 120 # yearly cost of full-disk encryption + management
new_ef = 0.1 # encrypted: a thief gets the hardware, not the data (1,500 of 15,000)
new_ale = asset_value * new_ef * aro
print(f"With encryption: ALE = ${new_ale:,.0f} per year, saving ${ale - new_ale - control_cost:,.0f} a year after its cost")
PS> python risk.py SLE = $15,000 per incident ALE = $3,000 per year With encryption: ALE = $300 per year, saving $2,580 a year after its cost
On Linux or WSL use python3 risk.py. Change aro to 1 (once a year) or the control cost to 5,000 and see when the control stops paying for itself. The numbers are made up for practice; real ones come from your own incident history and insurer data.
Where this fits
This is part of the free CompTIA Security+ roadmap: every StashGrid lesson mapped to the exam domains.
NextBack to the Security+ roadmap→
Go deeper
- Backup and restore drill — RPO and RTO in practice
- High availability, DR and documentation — redundancy and recovery sites
- Cryptography and PKI — the encryption control used above
Explainer, written by StashGrid with AI help and checked against the CompTIA Security+ V8 (SY0-801) exam objectives before publishing. Every command was run in Ubuntu 24.04 (WSL, OpenSSL 3.0.13) and Windows 11 PowerShell on 30 Oct 2026. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.