An asset is worth $10,000. The likelihood of an attack is once every two years with an expected impact of 80% damage. The risk acceptance level is $2000. A control that would reduce the risk to $1000 per event is available at an annual cost of $4000. Should the company implement the control?

Calculate SLE, ARO and ALE. Then calculate residual risk once the control is implemented.