Which metric represents the total amount of loss anticipated over a year due to single loss events?

The correct answer is the Annual Loss Expectancy (ALE). This metric quantifies the total anticipated loss over a year from potential security incidents, specifically assessing the financial impact of single loss events based on their frequency and severity.

ALE is calculated by multiplying the Single Loss Expectancy (SLE)—which reflects the potential monetary loss from a single occurrence of a risk event—by the Annual Rate of Occurrence (ARO), which estimates how often that risk event is expected to happen in a year. Thus, ALE provides organizations with a comprehensive view of their potential losses, allowing for better risk management and budgeting for security measures.

For contextual understanding, Single Loss Expectancy (SLE) measures the loss from one incident, while Annual Rate of Occurrence (ARO) estimates how often incidents occur annually. Exposure Factor (EF), on the other hand, is the percentage of loss a single incident would create in relation to an asset's value, but it does not aggregate the financial impact over time. Therefore, it is ALE that encapsulates the yearly risk financial impact based on both the severity of single incidents and their frequency.