What does ARO stand for?
ARO stands for Annualized Rate of Occurrence. How many times a year a given loss event is expected to happen. A flood every 10 years has an ARO of 0.1.
ARO is the number of times a specific risk event is expected to happen in one year. An event expected every year has an ARO of 1; one expected every ten years has an ARO of 0.1; one expected four times a year has an ARO of 4. The figure comes from history, vendor or insurance data and judgement. It is one of the two inputs for the annualized loss expectancy.
ARO in practice: an example
Over the last five years a branch office has had two break-ins. The risk analyst sets the ARO for burglary at 0.4. With an SLE of 15,000 dollars per break-in, the expected loss is 6,000 dollars a year, which is the number compared with the price of an alarm contract.
What ARO is confused with
ARO vs ALE: what is the difference?
ARO is a count per year. ALE is money per year, obtained by multiplying the ARO by the single loss expectancy. What ALE stands for
ARO vs MTBF: what is the difference?
MTBF describes how long a repairable component runs between failures. ARO describes how often a risk event of any kind is expected in a year. What MTBF stands for
Which exams cover ARO?
ARO is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 5.2 (Security Program Management and Oversight).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A data centre expects a major cooling failure once every five years. What is the ARO?
- 5
- 0.5
- 0.2
- 20
Show the answer
C. 0.2. One occurrence in five years is one fifth of an occurrence per year, or 0.2.
2. Phishing incidents that need a full account reset happen about twelve times a year. What is the ARO?
- 0.12
- 1
- 12
- 120
Show the answer
C. 12. ARO is simply the expected count per year, and it can be greater than 1 for frequent events.
Sources: NIST IR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management; NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.