Open FAIR 2 Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk (Open FAIR)

The probable frequency and probable magnitude of future loss. Expressed as a distribution, not a single number, reflecting uncertainty in both likelihood and impact.

Loss Exposure

The combination of a probable frequency and probable magnitude of loss for a defined asset, threat, and effect. It is the unit of analysis in Open FAIR.

Risk Analysis vs Assessment

Analysis quantifies risk using factor decomposition and simulation. Assessment adds evaluation against risk criteria and tolerance to support a decision.

Frequency vs Magnitude

Frequency is how often loss events occur per unit time, usually per year. Magnitude is the monetary size of loss when an event occurs.

Risk Scenario

A statement specifying an asset, a threat community, a threat effect, a loss event, and a loss form so that it can be decomposed and quantified.

Inherent vs Residual Risk

Inherent risk is measured before controls are applied. Residual risk is measured after accounting for the efficacy of existing controls.

Uncertainty in Open FAIR

Represented explicitly through probability distributions for each factor. Wide ranges indicate weak evidence, not necessarily poor analysis quality.

Calibrated Estimation

An elicitation method producing 90% confidence intervals where the true value falls inside the stated range roughly nine times out of ten.

Loss Event Frequency (LEF)

The probable frequency, per unit time, that a threat agent causes loss to an asset. It equals Threat Event Frequency multiplied by Vulnerability.

Threat Event Frequency (TEF)

The probable frequency that a threat agent acts against an asset. It equals Contact Frequency multiplied by Probability of Action.

Vulnerability (FAIR)

The probability that a threat event becomes a loss event. Modeled as the relationship between Threat Capability and Resistance Strength.

Threat Capability

The skill, resources, and effectiveness of a threat community relative to the controls protecting the asset. Higher capability raises Vulnerability.

Resistance Strength

The effectiveness of controls in resisting a threat action. Higher resistance strength lowers Vulnerability for a given level of Threat Capability.

Contact Frequency

How often a threat community encounters or can reach the asset. It is one of two inputs to Threat Event Frequency.

Probability of Action

The likelihood a threat community will act against the asset given contact. Driven by intent and perceived value or reward.

Loss Magnitude (LM)

The probable monetary loss per loss event. It is the sum of Primary Loss and Secondary Loss for the scenario.

Primary Loss

Losses borne directly by the asset owner, such as productivity, response, replacement, and competitive advantage losses.

Secondary Loss

Losses from reactions of external stakeholders, such as fines, judgments, and reputation damage. It equals Secondary Loss Event Frequency times Secondary Loss Magnitude.

Secondary Loss Event Frequency

The probability that a primary loss event triggers a secondary response from external stakeholders such as regulators, customers, or investors.

Loss Forms

Categories of harm: productivity, response, replacement, fines and judgments, competitive advantage, and reputation. Used to structure loss magnitude estimates.

Threat Community

A group capable of acting against an asset, characterized by capability, intent, and access. Examples include insiders, criminals, and nation-states.

Risk Ontology

The hierarchical factor model linking Risk to Loss Event Frequency and Loss Magnitude, then decomposing each into measurable sub-factors.

Control Mapping to Factors

Avoidance lowers Contact Frequency; deterrence lowers Probability of Action; prevention and detection lower Vulnerability; response and recovery lower Loss Magnitude.

Scope Definition

The first process step: define the decision, assets, threats, time horizon, and level of analysis before identifying scenarios.

Monte Carlo Simulation

A method that samples repeatedly from input factor distributions to produce an output distribution of loss, rather than a single average.

Loss Exceedance Curve

A plot showing the probability that loss exceeds a given amount. It summarizes the full risk distribution and supports tolerance comparisons.

Sensitivity Analysis

Identifies which input factor most influences the output distribution, guiding where control investment or further data collection matters most.

Distribution Choice

Selecting triangular, lognormal, or PERT shapes for factor inputs based on the shape of belief about that factor and its plausible bounds.

Risk Appetite

The amount of risk an organization is willing to accept, typically expressed as an acceptable probability of exceeding a stated loss threshold.

Risk Tolerance

The boundary of acceptable deviation from risk appetite, used to decide whether a scenario requires treatment or acceptance.

Efficient Frontier (Risk)

A comparison of candidate controls showing the greatest risk reduction achievable for each level of investment, supporting cost-effective selection.

Aggregation Caution

Summing expected values across scenarios ignores correlation and tail dependence, potentially understating aggregate risk. Model dependencies explicitly.