Risk Management Formulas
The quantitative formulas are the only maths on Security+ and they appear most years. The worked example runs one scenario through every formula so the relationships are visible.
Risk Management Formulas · firsttry.app/cheatsheets/risk-management · original reference written from published exam objectives. Not affiliated with any certification body.
The formulas
| Term | Formula | Means |
|---|---|---|
| AV | Asset value | What the asset is worth |
| EF | Exposure factor | Percentage of the asset lost in one event |
| SLE | AV x EF | Cost of one occurrence |
| ARO | Annual rate of occurrence | How many times a year it is expected |
| ALE | SLE x ARO | Expected cost per year |
| Control value | ALE before minus ALE after minus control cost | Whether a control is worth buying |
Worked example
| Step | Working | Result |
|---|---|---|
| Asset value | A server and its data | $50,000 |
| Exposure factor | A fire destroys 60% of its value | 0.6 |
| SLE | $50,000 x 0.6 | $30,000 |
| ARO | Expected once every five years | 0.2 |
| ALE | $30,000 x 0.2 | $6,000 per year |
| Control | Suppression system reduces EF to 0.1, costs $2,000 a year | New ALE $1,000 |
| Worth it | $6,000 minus $1,000 minus $2,000 | $3,000 saved per year. Buy it |
Risk treatment
| Treatment | What it means | Example |
|---|---|---|
| Avoid | Stop doing the risky thing | Retire the service |
| Mitigate | Reduce likelihood or impact | Patch it, add a control |
| Transfer | Move the financial consequence | Insurance, or a contract clause |
| Accept | Document and carry it | Signed off by a risk owner |
| Exemption / exception | Formally approved deviation | Time limited, with compensating controls |
Continuity metrics
| Metric | Question it answers |
|---|---|
| RTO | How long may this be down before it hurts |
| RPO | How much data may we lose |
| MTTR | How long does a repair take on average |
| MTBF | How long between failures on average |
| MTTF | Average life of a non-repairable item |
| Maximum tolerable downtime | The outer limit RTO must sit inside |
Exams covered
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.