ALE - mALE = Savings
A: $400,000 - $200,000 = $200,000
B: $400,000 - $380,000 = $20,000

This is the step at which executives will want to interact with themodel, seeing how different measures that they take affect their mALE.

Now, to get a basic return, you simply subtract the cost to implementeach mitigation measure from your savings on your mALE by implementingthe mitigation. Let's say mitigation A, antivirus software, costs$120,000. And mitigation B, an awareness program, costs $8,000. Then:

Savings - Mitigation cost = ROSI
A: $200,000 - $120,000 = $80,000
B: $20,000 - $8,000 = $12,000

Both mitigation measures provide a ROSI (if the final number came outnegative, then you're spending more than you're getting back).Awareness actually has a higher return; or put another way, you getthe most bang for the buck. (Your savings are 2.5 times what youspend, whereas in the antivirus case, they are 1.7 times what youspend.)