An IT manager is concerned about the cost of implementing a web filtering solution in an effort to mitigate the risks associated with malware and resulting data leakage. Given that the ARO is twice…

$0 is incorrect because the web filter reduces but does not eliminate risk, as demonstrated by the remaining residual ALE of $15,000 per year.

SLE is calculated as ALE divided by ARO. After implementing the web filter, the residual ALE is $15,000 and the ARO remains 2 (twice per year), so SLE = $15,000 / 2 = $7,500. This represents the expected monetary loss from a single data leakage event under the post-control risk environment.

$10,000 is the annual cost of the web filtering control itself, not a loss expectancy value derived from the ALE and ARO.

$12,500 represents the pre-implementation SLE ($25,000 ALE / 2 ARO), not the SLE after the web filter is deployed.

$15,000 is the post-implementation ALE, which is an annualized figure, not the single loss expectancy for one individual event.