Asset A is subject to a DDoS attack that occurs weekly $(52$ weeks per year$).$ This asset has an impact rating of $60$ with existing controls in place that reduce the impact of this vulnerability such that only $75\%$ of of the assets value is compromised each time the vulnerability is exploited $(25\%$ of the loss is mitigated$).$ You are $90\%$ certain of your assumptions and data.

Asset B has a Web application that can be attacked by SQL injections. These injections occur monthly $(12$ months per year$).$ This asset has an impact value of $80$ and existing controls reduce the impact of any injection such that only $50\%$ of the asset's value is compromised each time the vulnerability is exploited $(50\%$ of the loss is mitigated$).$ You are $80\%$ certain of your assumptions and data.