The Cost Benefit Analysis (CBA) Formula
CBA determines that whether the control alternative being evaluated is worth cost incurred to control vulnerability or not. CBA easily calculated by using ALE from earlier assessments, before implementation of control proposed:
- CBA = ALE (prior) – ALE (post) – ACS
- ALE (prior) is annualized loss expectancy of risk before implementation of control
- ALE (post) is estimated ALE based on control being in place for the period of time
- ACS is annualized cost of safeguard.