- ClassificationCategoryRisk ManagementDomainRisk ManagementFramework FamilyOther
- Regulatory ContextTypeStandardLegal InstrumentStandardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailInternationalPublisherThe Open Group
- VersioningVersionO-RT Version 3.1 (C251) and O-RA Version 2.1 (C250), May 22, 2025Effective DateMay 22, 2025Issue DateMay 22, 2025 (supersedes O-RT 3.0.1 and O-RA 2.0.1 of November 2021)
- AdoptionAdoption ModelVoluntaryImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
The O-RT and O-RA standards are free PDF editions downloaded from The Open Group's publications site after login, with a commercial license available for commercial use; their text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- Open FAIR is The Open Group's pair of standards for quantitative information risk analysis: the Risk Taxonomy (O-RT) 3.1 and Risk Analysis (O-RA) 2.1.
- Both were published May 22, 2025, superseding the November 2021 editions, with changes limited to the CSF 2.0 Governance Function.
- It is The Open Group's standardization of Factor Analysis of Information Risk (FAIR) and is voluntary.
- Together the two standards form the Open FAIR Body of Knowledge behind the certification program launched in 2014.
- SmartSuite holds the risk register, the controls and the framework mappings; loss exposure calculated in a FAIR tool can be recorded on each risk as an Annual Loss Expectancy.
Overview
Open FAIR is The Open Group's pair of standards for quantitative information security risk analysis: the Risk Taxonomy (O-RT) Standard, Version 3.1 (document C251), and the Risk Analysis (O-RA) Standard, Version 2.1 (document C250), both published on May 22, 2025. It is The Open Group's standardization of Factor Analysis of Information Risk (FAIR), and it is voluntary: risk analysts adopt it to express risk in consistent economic terms rather than as high, medium or low ratings. The O-RT provides a standard definition and taxonomy for information security risk and information on how to use the taxonomy; the O-RA provides a set of standards for the aspects of information security risk analysis; each names the other as its companion document.
The 2025 editions supersede O-RT Version 3.0.1 (C20B) and O-RA Version 2.0.1 (C20A) of November 2021. The Open Group's Security Forum made the update after NIST published Cybersecurity Framework 2.0: the changes to the standards are limited to addressing the new Governance Function from the CSF 2.0, with other small changes for consistency between the two documents. Together the two standards form the Open FAIR Body of Knowledge, on which the Open FAIR Certification Program has been based since its launch in 2014.
The Open Group says the Open FAIR standards can be applied to any risk scenario, which lets the Body of Knowledge serve as a foundation for normalizing risk analysis results across varied risk domains, and that the method is directly applicable with other standards: practitioners who must perform risk assessments under other industry and regulatory frameworks can use the Open FAIR taxonomy and framework to build consistent and defensible risk statements measured in the same economic terms as the other risks they manage. Both standards are free to download as PDFs after registration on The Open Group's publications site, with a commercial license available for commercial use.
Why does it matter?
Most risk registers rate risks as high, medium or low, which cannot tell a board how much loss exposure it carries or whether a control is worth its cost. The Open Group's case for Open FAIR starts with the taxonomy: without a logical, tightly defined taxonomy, risk analysis approaches are significantly impaired by an inability to measure or estimate risk factors, management lacks the information for well-informed comparisons and choices, and risk decisions become inconsistent and often cost-ineffective. The O-RT supplies the clear definition of Open FAIR risk factors and risk factor relationships, and the O-RA the analysis process, so that one analysis can be compared with another and defended when challenged.
Key benefits include:
- A shared definition of risk
The O-RT gives risk analysts one standard definition and taxonomy for information security risk, so analysis work from different teams and domains uses the same factors and relationships.
- Results in economic terms
Open FAIR produces risk statements measured in the same economic terms as the other risks an organization manages, which The Open Group describes as consistent and defensible.
- A documented process
The O-RA standardizes the aspects of information security risk analysis, and the Risk Analysis Process Guide (G180) and Example Guide (G21A) show how an analysis is performed and reported.
- Works inside other frameworks
The method is directly applicable with other standards; The Open Group publishes cookbooks for the NIST Cybersecurity Framework (G167) and ISO/IEC 27005 (C103).
- Recognized certification
The Open FAIR Certification Program, launched in 2014 and based on the two standards, had more than 1,700 certified individuals when the 2025 editions were announced.
How does it work?
The Body of Knowledge has two documents. The O-RT (C251, 42 pages) provides the standard definition and taxonomy for information security risk and information on how to use the taxonomy; The Open Group describes it as defining the Open FAIR risk factors and the relationships between them, which is what makes the factors measurable or estimable. The O-RA (C250, 48 pages) provides the standards for performing an information security risk analysis using the taxonomy. The documents are written as companions and are updated together: the 2025 editions carry consecutive ISBNs and the same publication date.
Supporting publications turn the standards into practice. The Open FAIR Risk Analysis Process Guide (G180, September 2022) sets out how to apply the methodology; the Risk Analysis Example Guide (G21A, July 2021) compares a qualitative and a quantitative version of the same risk scenario and then uses an analysis, with calibrated estimates as inputs, to inform a business case; the Mathematics for the Open FAIR Methodology Guide (G224, September 2022) explains how the Open FAIR concepts translate into probability models. The Open FAIR Risk Analysis Tool (I181, January 2018) is a Microsoft Excel spreadsheet for performing an analysis as defined in the two standards, and the SIPmath guide (G181) defines the algorithms an acceptable implementation of the O-RA can use.
An organization adopts Open FAIR by training or certifying its analysts, choosing the scenarios to quantify, and running each analysis with the process guide and tool, then placing the results inside the risk assessment steps of the frameworks it already follows. The cookbooks show how: the NIST Cybersecurity Framework Cookbook (G167, October 2016) applies Open FAIR to the CSF, and the ISO/IEC 27005 Cookbook (C103, November 2010) applies it to ISO/IEC 27005 and is written so practitioners can follow the same approach for other frameworks. The 2025 update aligned the standards with the CSF 2.0 Govern function without changing the certification exam, which The Open Group Certification Authority said it did not anticipate changing.
Key Elements
- Risk Taxonomy (O-RT) Standard, Version 3.1
Document C251, published May 22, 2025, 42 pages, supersedes C20B: the standard definition and taxonomy for information security risk and how to use it.
- Risk Analysis (O-RA) Standard, Version 2.1
Document C250, published May 22, 2025, 48 pages, supersedes C20A: the standards for the aspects of information security risk analysis.
- Open FAIR Body of Knowledge
The O-RA and O-RT together; applicable to any risk scenario and usable as a foundation for normalizing analysis results across risk domains.
- Risk factors and relationships
The O-RT defines the Open FAIR risk factors and risk factor relationships that guide professionals in their analysis of risks and make the factors measurable or estimable.
- Open FAIR Certification Program
Launched 2014; Open FAIR Foundation and Open FAIR 2 Foundation certifications; more than 1,700 certified individuals; accredited training or self-study materials.
- Process, example and mathematics guides
G180 (September 2022), G21A (July 2021) and G224 (September 2022), plus the Lifelong Learning module Risk Analysis - Process, which leads to an Open Badge.
- Risk Analysis Tool and SIPmath guide
I181 (January 2018), an Excel tool for a quantitative Open FAIR analysis, and G181 (January 2018), the theory of operation for an acceptable O-RA implementation.
- Cookbooks
Open FAIR - NIST Cybersecurity Framework Cookbook (G167, October 2016) and Open FAIR - ISO/IEC 27005 Cookbook (C103, November 2010).
What does it cover?
Open FAIR applies to any organization, in any sector, that wants to analyze information security risk quantitatively; The Open Group says the standards can be applied to any risk scenario. The documents define risk and the analysis of risk: they do not prescribe security controls, and they are positioned as a way to quantify risk within other information security standards and frameworks rather than as a replacement for them. They are used by risk analysts and the organizations that employ them, by leaders who need risk statements in economic terms, and by the training course providers and candidates in the Open FAIR Certification Program; they are free to download for internal use, with a commercial license for commercial application.
What are its objectives?
The standards and their companion publications exist so that information security risk can be defined, analyzed and communicated consistently. They:
Provide a standard definition and taxonomy for information security risk, with information on how to use the taxonomy (O-RT).
Provide a set of standards for the aspects of information security risk analysis (O-RA).
Let practitioners build consistent and defensible risk statements measured in the same economic terms as the other risks they manage.
Give analysts a way to quantify risk within other information security standards and frameworks to inform risk assessments.
Serve as a foundation for normalizing risk analysis results across varied risk domains.
Underpin the Open FAIR Certification Program and its Foundation and 2 Foundation certifications.
Framework in Context
The Open Group holds the standards and publishes them through its Security Forum, with the 2025 editions announced on May 22, 2025 by its Security Portfolio Director and its Director of Learning and Certifications. The update tracked NIST Cybersecurity Framework 2.0, whose new Govern function the standards now address, and The Open Group's own cookbooks place Open FAIR inside the NIST CSF and ISO/IEC 27005. Supplementary white papers cover calculating reserves for cyber risk, vetting cyber risk models, using calibrated estimates for VaR and CVaR calculations and combining Open FAIR with threat modeling. The Open Group's Open FAIR page still describes Versions 3.0.1 and 2.0.1; the publications catalog entries for C251 and C250 are authoritative for the current editions.
Common Framework Mappings
Open FAIR is commonly mapped to the risk management and assessment standards it quantifies and to the control frameworks whose priorities it informs.
Mapped frameworks include:
NIST SP 800-30 Rev. 1
ISO 27005:2022
ISO 31000:2018
ISO 31010:2009
NIST CSF 2.0
NIST SP 800-39
COSO ERM 2017
ISO 27001:2022
NIST 800-53 Rev.5
CIS Controls v8.1
How SmartSuite Supports Open FAIR
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
For Open FAIR, SmartSuite holds the risk register, the controls and the framework mappings; loss exposure calculated in a FAIR tool can be recorded on each risk as an Annual Loss Expectancy.
Risks Covered by an Open FAIR Analysis
Hold each risk an Open FAIR analysis covers in the Enterprise Risk Management register, rated for inherent and residual likelihood and impact, with the rationale for each rating.
Risk Register, Controls and Mappings
SmartSuite holds the risk register, the controls and the framework mappings for each risk an Open FAIR analysis covers. The analysis itself runs in a FAIR tool.
Loss Exposure as Annual Loss Expectancy
Record the loss exposure calculated in a FAIR tool on each risk as an Annual Loss Expectancy, so it reports beside the rated risks in Enterprise Risk Management.
Framework Risk Assessment Link
Link each risk to the NIST Cybersecurity Framework and ISO/IEC 27005 frameworks and the controls it maps to, the programs the Open FAIR cookbooks describe.
Owners and Assessment Cadence
Name a risk owner and a risk analyst on each risk, set its assessment frequency and next assessment date, and schedule re-analysis in a FAIR tool when the environment or the standards change.
Executive Risk Reporting
Use Enterprise Risk Management to report loss exposure and business-case comparisons to executives and the board in the same economic terms as the organization's other risks.
Related frameworks
NIST SP 800-30 Rev. 1 is the NIST guide for conducting information security risk assessments: how to prepare, conduct, communicate, and maintain them at every tier of the organization.
ISO/IEC 27005:2022 provides guidance on identifying, analyzing, evaluating, and treating information security risks in support of an ISO/IEC 27001 ISMS.
ISO 31000:2018 gives guidelines on managing risk through eight principles, a framework and a process for any organization. It is not certifiable. ISO published it on February 14, 2018.
IEC 31010:2019 gives guidance on selecting and applying risk assessment techniques, and replaced the 2009 first edition in June 2019.
NIST SP 800-39 is the NIST guideline for an organization-wide information security risk program: frame, assess, respond and monitor across the organization, mission and system tiers.
Frequently Asked Questions For Open FAIR
The Risk Taxonomy (O-RT) Standard, Version 3.1, document C251, and the Risk Analysis (O-RA) Standard, Version 2.1, document C250, both published by The Open Group on May 22, 2025. The O-RT (42 pages) supersedes C20B, O-RT Version 3.0.1, and the O-RA (48 pages) supersedes C20A, O-RA Version 2.0.1, both of November 2021. The Open Group's Open FAIR page still lists the 2021 versions; the publications catalog entries are current.
The Open Group's announcement of May 22, 2025 says the changes to the standards are limited to addressing the new Governance Function from NIST Cybersecurity Framework 2.0, with other small changes made to ensure consistency between the two documents. The Certification Authority did not anticipate any change to the Open FAIR certification exam, and the Open FAIR Conformance Requirements were being updated separately.
The Body of Knowledge is the O-RA and O-RT standards together. The Open FAIR Certification Program, launched in 2014, is based on it and comprises the Open FAIR Foundation and Open FAIR 2 Foundation certifications, which candidates prepare for through an accredited training course provider or The Open Group's self-study materials. In May 2025 the program had more than 1,700 certified individuals.
Yes. The Open Group says the Open FAIR method is directly applicable with other standards and provides a way to quantify risk within them to inform risk assessments. It publishes the Open FAIR - NIST Cybersecurity Framework Cookbook (G167, October 2016) and the Open FAIR - ISO/IEC 27005 Cookbook (C103, November 2010), the latter written so practitioners can follow by example how to apply Open FAIR to other frameworks of their choice.
Both standards are available as free PDF editions after login on The Open Group's publications site, and The Open Group says its Open FAIR publications are free to download and use within organizations. A commercial license is available for organizations applying the Open FAIR Body of Knowledge for commercial use. The companion guides, white papers and the Excel-based Risk Analysis Tool are published alongside the standards.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.