What is FAIR (Factor Analysis of Information Risk)?

What is FAIR (Factor Analysis of Information Risk)?

FAIR (Factor Analysis of Information Risk) is a quantitative model for analyzing information and operational risk in financial terms, defining risk as the probable frequency and probable magnitude of future loss.

FAIR is standardized by The Open Group as Open FAIR, in two documents: the Risk Taxonomy (O-RT) standard, which defines the terms and the decomposition of risk, and the Risk Analysis (O-RA) standard, which describes how to run an analysis. The taxonomy states that risk is the probable frequency and probable magnitude of future loss, and splits it into loss event frequency and loss magnitude. The FAIR Institute maintains the practitioner community and training. FAIR does not replace a control framework; it is a method for measuring the risk that frameworks such as NIST CSF or ISO/IEC 27001 aim to reduce.

Why it matters

• It speaks in money. A risk expressed as an annualized loss range can be compared with the cost of a control and with other business risks.
• It disciplines estimation. Decomposing risk into factors with calibrated ranges exposes assumptions that a high, medium, low rating hides.
• It fits cyber risk quantification. FAIR is the most widely adopted open model for putting a financial figure on cyber and technology risk.

The FAIR taxonomy

Loss event frequency is how often a loss event is expected to occur in a period. It derives from threat event frequency (how often a threat agent acts against the asset) and vulnerability (the probability that the action results in loss, which depends on the threat's capability against the control strength). Loss magnitude is the expected loss when the event occurs, split into primary loss (direct costs such as response, replacement and lost productivity) and secondary loss (reactions from customers, regulators and others, including fines, legal costs and reputational effects).

Running a FAIR analysis

• Scope a scenario: a specific asset, threat, effect (confidentiality, integrity or availability) and loss type.
• Estimate each factor as a range (minimum, most likely, maximum) with a confidence level, using data where it exists and calibrated expert judgment where it does not.
• Run a simulation, usually Monte Carlo, to combine the ranges into a distribution of annualized loss.
• Present results as ranges and probabilities, such as the loss exceeded in one year in ten, and compare against risk appetite and control options.

When to use FAIR

FAIR earns its effort where the answer changes with the number: whether a control investment is justified, how much cyber insurance to buy, or what to report to the board as exposure. Most programs quantify a handful of top scenarios and keep qualitative scoring for the long tail.

Related terms

• Cyber risk assessment
• Risk analysis
• Cyber risk management
• Risk scoring and prioritization
• Scenario analysis
• Risk appetite and risk tolerance

In SmartSuite

SmartSuite Cyber and IT Risk can hold FAIR scenarios alongside the qualitative register, with fields for each factor's range, the simulation results and the decision they informed, so quantified and rated risks report through the same dashboards.

Frequently asked questions

Is FAIR a framework or a standard?

Both, in a sense. FAIR is a model for analyzing risk. It is published by The Open Group as two standards, the Risk Taxonomy (O-RT) and Risk Analysis (O-RA) standards, collectively Open FAIR. It is not a control framework; it measures the risk that control frameworks such as NIST CSF or ISO/IEC 27001 are meant to reduce.

Does FAIR require a lot of data?

Less than people assume. FAIR uses ranges rather than point estimates, so calibrated expert judgment can stand in where data is thin, and the ranges widen to show the uncertainty. Internal incident records, industry breach data and control test results narrow the ranges over time. The discipline is in documenting the basis of each estimate.

How does FAIR relate to a risk matrix?

A risk matrix rates likelihood and impact on ordinal scales and places risks in cells. FAIR replaces the scales with estimated frequencies and financial magnitudes and produces a loss distribution. Many organizations keep the matrix for broad screening and apply FAIR to the risks that reach the top cells, where a financial figure will change the decision.