Quantifying Impact: ALE and Business Impact Analysis

Lesson plan

Level

Beginner

Time

About 55 minutes; the steps below add up to 55

Learners turn “£20,000 every four years” into an annual figure themselves, and decide whether it predicts this year’s bill, before SLE, ARO and ALE are named. Predictions then precede whether a control cheaper than the ALE is worth it, the single loss from an exposure factor, the two controls’ new ALEs, server against activity, a telephone-only variation and what ALE misses; checks follow a twice-yearly incident, the cost comparison and the RPO. The habit to build: write down the assumptions behind every number, and start continuity thinking from the activity.

Objectives

• Calculate ALE from SLE and ARO, and SLE from asset value and exposure factor
• Explain what an annual loss figure does and does not mean
• Compare controls by the reduction in loss they bring, not the whole ALE
• Use a Business Impact Analysis to set recovery targets from an activity and its dependencies
• Say what ALE and BIA each show and leave out

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Assessing Risk lesson first.
• Calculators help; keep the formula SLE × ARO = ALE on the board throughout.
• The lesson takes about 55 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Calculate ALE from SLE and ARO, and SLE from asset value and exposure factor
   • Explain what an annual loss figure does and does not mean
   • Compare controls by the reduction in loss they bring, not the whole ALE
   • Use a Business Impact Analysis to set recovery targets from an activity and its dependencies
   • Say what ALE and BIA each show and leave out

   Purpose: Learners turn “£20,000 every four years” into an annual figure themselves, and decide whether it predicts this year’s bill, before SLE, ARO and ALE are named. Predictions then precede whether a control cheaper than the ALE is worth it, the single loss from an exposure factor, the two controls’ new ALEs, server against activity, a telephone-only variation and what ALE misses; checks follow a twice-yearly incident, the cost comparison and the RPO. The habit to build: write down the assumptions behind every number, and start continuity thinking from the activity.

2. 1. What might it cost? Think 5 min

   Purpose: Let learners derive an annualised figure and question what it means.

   Ask

   • How could you compare the two figures with £3,000?
   • Will £5,000 be paid this year?

   Responses to expect

   • £5,000 comes quickly; the second question exposes the forecast misreading.
   • On screen in turns: the opening question, its answer; then the question on this year’s bill, and its answer.

   Discussion pause: Let learners work the division before revealing.

   In the lesson window

   • Think it through: A manager must decide whether to spend £3,000 a year on a control against ransomware. One incident would cost about £20,000, and one is expected roughly every four years. How could you turn those two figures into something to compare with the £3,000?
   • Think it through: Does an average of £5,000 a year mean the organisation will pay £5,000 this year?

3. 2. Annualised Loss Expectancy Explain 10 min

   Purpose: Name SLE, ARO and ALE, what the figure means and how to use it in a decision.

   Ask

   • What is the ALE at twice a year?
   • Is a £4,000 control automatically worth it?

   Responses to expect

   • ARO as a probability is the common slip.
   • On screen in turns: the opening; then SLE, ARO and ALE, with the worked values held back; the worked value of each; the calculation; the check question on twice a year, and its answer; both figures are estimates; what £5,000 per year means; an ARO is not a probability; recording the assumptions; the question on a control cheaper than the ALE, and its answer; compare with the expected reduction in loss; ALE is one input.

   Misconceptions to challenge

   • A learner may believe: “An ARO of 0.25 is a 25% chance.” Respond: It is a frequency; treating it as a probability needs more assumptions.
   • A learner may believe: “Any control cheaper than the ALE is worth buying.” Respond: Compare cost with the reduction in loss it brings.

   In the lesson window

   • Check your understanding: If the same £20,000 incident were expected twice a year, what would the ALE be?
   • Think it through: A control costs £4,000 a year, less than the £5,000 ALE. Is it automatically worth buying?

4. 3. Where the single loss figure comes from Predict 5 min

   Purpose: Build SLE from asset value and exposure factor.

   Ask

   • What is the single loss at 40%?

   Responses to expect

   • Some multiply by 40 rather than 0.4.
   • On screen in turns: the opening; then SLE = asset value × exposure factor; the question on forty per cent, and its answer; the single loss, built up.

   In the lesson window

   • Think it through: The affected systems and data are worth £50,000, and one incident would destroy about 40% of that value. What is the single loss?

5. 4. Worked control comparison Predict 7 min

   Purpose: Compare two controls that reach the same ALE by different routes.

   Ask

   • Predict each new ALE.
   • Which saves more than it costs?

   Responses to expect

   • Learners often stop at “both £2,000”.
   • On screen in turns: the opening; then the question on two routes, and its answer; two controls against the baseline; Control A; Control B, and what the comparison shows; the check question on which control saves more, and its answer; assumptions made for teaching.

   Discussion pause: Reveal the controls one at a time; ask for each ALE and whether it saves more than it costs before it appears.

   To go further

   • What evidence would you want before believing Control A really makes incidents rarer?

   In the lesson window

   • Think it through: Control A makes incidents rarer, about once every ten years. Control B makes each incident cheaper, £8,000. Before looking at the figures, predict each new ALE.
   • Check your understanding: Both controls bring the ALE down to £2,000, a saving of £3,000. Control A costs £1,800 a year; Control B costs £3,500. On these figures, which saves more than it costs?

6. 5. Business Impact Analysis Predict 12 min

   Purpose: Start from the activity, and derive RTO and RPO with the worked example and its variation.

   Ask

   • Server or activity?
   • How often must you back up for a 24-hour RPO?
   • What if What changes if bookings are telephone-only?

   Responses to expect

   • RTO and RPO are often swapped.
   • On screen in turns: the opening question, its answer; then the Business Impact Analysis; following the activity, starting with what stops; how long the team can manage; how much data they could lose; what the two figures require; what the activity depends on; the check question on an RPO of 24 hours, and its answer; the result: two testable numbers; the question on telephone-only bookings, and its answer; changing one fact; targets and measurements; MTTR and MTBF; CVSS, BIA and risk assessment.

   Misconceptions to challenge

   • A learner may believe: “BIA tells us how likely an attack is.” Respond: It examines consequences of disruption; likelihood is separate.

   If the explanation does not land: Ask: how long could the team cope without it (RTO), and how much recent work could they afford to redo (RPO)?

   In the lesson window

   • Think it through: A customer database fails. Which is the more useful question: “how important is the server?” or “how important is the work people do with it?” Why?
   • Check your understanding: With an RPO of 24 hours, how often must the database at least be backed up?
   • Think it through: Suppose bookings arrived only by telephone, with nothing written down. What happens to the RPO, and to the backup plan?

7. 6. How ALE and BIA fit together Predict 4 min

   Purpose: Compare what ALE and BIA show and leave out, and how they support each other.

   Ask

   • What might a board miss in an ALE?

   Responses to expect

   • The worst single year.
   • On screen in turns: the opening question, its answer; then ALE and BIA compared, with the BIA column held back; the BIA column; the two support each other; three checks on an annual loss figure.

   In the lesson window

   • Think it through: What might an ALE figure fail to show that a board would care about?

8. 7. Apply it in a new situation Apply 5 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The help desk tests ARO above 1; the budget tests the average; the sign-in service tests dependencies.
   • On screen in turns: the opening; then the question on three incidents a year, and its answer; the question on a budget line, and its answer; the question on a two-hour target, and its answer.

   In the lesson window

   • Apply it: A help desk expects about three incidents of password-reset fraud a year, each costing £600. What is the ALE?
   • Apply it: A finance director reads “ALE £5,000” and puts £5,000 into next year’s budget as a certain cost. What do you explain?
   • Apply it: A BIA sets a two-hour RTO for online ordering. The database can be restored in an hour, but the sign-in service takes three. Is the RTO met?

9. 8. Check your understanding Check 5 min

   Purpose: Check the lesson against the approved revision-bank questions.

   Ask

   • Answer individually, then compare before revealing.

   Responses to expect

   • The ARO question links to the twice-a-year check.
   • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

10. 9. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the ALE formula, and what an RPO measures.

    Responses to expect

    • SLE × ARO; the most data, as time, that can be lost.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

11. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Loss per incident times incidents per year.
    • A frequency, not a probability.
    • An average, not a forecast.
    • Cost against the reduction it buys.
    • Start from the activity: RTO, RPO and dependencies.

Consolidation

• Loss per incident times incidents per year.
• A frequency, not a probability.
• An average, not a forecast.
• Cost against the reduction it buys.
• Start from the activity: RTO, RPO and dependencies.