Open FAIR 2 Foundation cheat sheet

Risk is defined as the probable frequency and probable magnitude of future loss; a single number is never a complete risk statement.

Risk = f(Likelihood, Impact); Open FAIR decomposes likelihood into frequency of threat events and vulnerability of assets.

Frequency is expressed as events per unit time (commonly per year); magnitude is expressed in monetary units.

Loss exposure is the combination of a probable frequency and probable magnitude for a defined asset, threat, and effect.

Risk analysis differs from risk assessment: analysis quantifies; assessment adds evaluation against risk criteria and tolerance.

FAIR analysis is factor-based and calibrated; inputs are expressed as probability distributions, not point estimates.

Uncertainty is represented explicitly; wide ranges signal weak evidence rather than poor analysis.

A risk scenario must specify asset, threat community, threat effect, loss event, and loss form to be analyzable.

Inherent risk is measured before controls; residual risk is measured after accounting for control efficacy.

Top-level ontology: Risk = (Loss Event Frequency, Loss Magnitude).

Loss Event Frequency = (Threat Event Frequency, Vulnerability); Vulnerability = (Resistance Strength, Threat Capability).

Threat Event Frequency = (Contact Frequency, Probability of Action).

Loss Magnitude = (Primary Loss, Secondary Loss); Secondary Loss = (Secondary Loss Event Frequency, Secondary Loss Magnitude).

Primary loss is borne directly by the asset owner; secondary loss is a response by external stakeholders (regulators, customers, investors).

Loss forms include productivity, response, replacement, fines and judgments, competitive advantage, and reputation.

Threat communities are characterized by capability, intent, and access; these drive Threat Capability and Probability of Action.

Resistance Strength reflects the controls protecting the asset; Threat Capability reflects the attacker's skill relative to those controls.

Control categories map to factors: avoidance reduces contact frequency; deterrence reduces probability of action; prevention and detection reduce vulnerability; response and recovery reduce loss magnitude.

Process flow: scope the analysis, identify scenarios, calibrate estimates, run the model, interpret results, communicate.

Scenario identification uses the taxonomy to decompose an asset-threat-effect statement into measurable factors.

Calibration replaces guessing with 90% confidence interval estimation; the range should contain the true value nine times out of ten.

Subject matter experts are calibrated before estimating; uncalibrated estimates are systematically overconfident.

Monte Carlo simulation combines factor distributions to produce a loss exceedance curve rather than a single average.

Loss exceedance curves answer 'what is the probability loss exceeds X?'; they support risk appetite comparisons.

Triangular, lognormal, and PERT distributions are common for factor inputs; choice depends on shape of belief about the factor.

Sensitivity analysis identifies which factor most influences the output, directing control investment.

Results should be expressed as a range with confidence, and assumptions documented for review and reproducibility.

Use loss exceedance curves to compare scenarios against risk tolerance thresholds and prioritize remediation.

Compare control options by modeling their effect on specific factors, not by assuming uniform risk reduction.

A control that reduces Threat Event Frequency does not reduce Loss Magnitude; model each factor separately.

Risk appetite is expressed as an acceptable probability of exceeding a loss threshold; tolerance sets the boundary.

Efficient frontier analysis compares risk reduction per dollar spent across candidate controls.

Aggregate scenarios carefully; summing expected values ignores correlation and tail dependence.

Communicate results to executives as frequency and magnitude in business terms, with explicit uncertainty.

Document scenario scope, data sources, calibration rationale, and model version for auditability.

Revisit analyses when threat landscape, asset value, or controls change materially.