Open FAIR 2 Foundation key terms

The probable frequency and probable magnitude of future loss. This definition ties risk to measurable loss events rather than to uncertainty in general, so each risk statement must eventually be expressible as a frequency and a loss amount.

The process of identifying, modeling, and quantifying the frequency and magnitude of loss from defined scenarios. It produces a risk estimate, not a control recommendation, and is distinct from risk evaluation and risk treatment.

The broader decision-support activity that combines risk analysis with risk evaluation. Analysis quantifies loss exposure; evaluation compares that exposure against the organization's risk criteria and tolerance to decide whether action is warranted.

The decision and action taken in response to an assessed risk, such as accepting, avoiding, transferring, or modifying it through controls. Open FAIR analysis informs treatment by showing which controls most reduce probable loss.

The amount of risk an organization is willing to accept in pursuit of its objectives, often expressed as a threshold of probable loss per year. It provides the benchmark against which analyzed risk is evaluated.

The broad, high-level willingness of an organization to take on risk to achieve its goals. Appetite is a general posture, while tolerance translates that posture into specific measurable limits for particular risk types.

A discrete, well-defined event or situation that could cause loss, described by a threat community, the asset at risk, and the resulting effect. Scenarios are the unit of analysis in Open FAIR.

The estimated rate, often per year, at which a loss event is expected to occur. It is expressed as a distribution rather than a single number, reflecting uncertainty in how often the event may happen.

The estimated amount of loss expected when an event occurs, expressed as a distribution of possible loss values. It captures both primary and secondary losses and reflects uncertainty in the size of impact.

A mathematical description giving the likelihood of each possible value of a variable, such as frequency or loss. Open FAIR uses distributions because risk inputs are uncertain ranges, not certain point values.

A computational technique that repeatedly samples from input distributions to generate an output distribution of results. Open FAIR uses it to combine frequency and magnitude inputs into a loss exceedance curve.

A graph showing the probability that loss will exceed each given amount over a period. It is a primary output of Open FAIR analysis and supports comparison of scenarios and treatment options.

A structured classification of the factors that drive risk, organizing them into frequency and magnitude components. The Open FAIR taxonomy provides a common vocabulary so analyses are consistent and comparable across the organization.

A formal specification of the entities, relationships, and dependencies that make up risk. It defines how factors such as threat, vulnerability, and loss combine, enabling consistent modeling and communication of risk.

A framework that decomposes risk into measurable factors of frequency and magnitude. It provides a taxonomy, an ontology, and a method for quantifying risk in financial terms to support decision-making.

The probable frequency of a loss event occurring within a given timeframe. It is derived from threat event frequency and vulnerability, forming the frequency half of the Open FAIR risk model.

The probable frequency with which a threat community acts against an asset in a way that could cause loss. It reflects contact frequency and the probability that the actor will act, before considering whether defenses hold.

The probability that a threat event becomes a loss event, given that the threat acts. It reflects the resistance strength of controls against the threat capability and is not simply the presence of a software flaw.

The level of force or skill a threat community can bring to bear against an asset, such as tools, expertise, and resources. Higher threat capability tends to increase the probability that defenses are overcome.

The effectiveness of controls in resisting a threat's actions against an asset. It is compared with threat capability to determine vulnerability, so controls only reduce risk when they exceed the threat's capability.

A group of actors with common characteristics, capabilities, and intent that may act against an asset. Identifying the relevant community is essential because different communities have different frequencies and capabilities.

The total loss resulting from a loss event, comprising primary loss and secondary loss. It is expressed as a distribution and forms the magnitude half of the Open FAIR risk model.

The direct loss suffered by the asset owner as an immediate result of a loss event, such as response costs, productivity loss, or replacement cost. It is distinct from losses borne by other parties.

Loss that falls on parties other than the asset owner and later affects the organization, such as fines, litigation, or reputation damage. It is often larger and less predictable than primary loss.

Anything of value to the organization that a threat could act upon, including data, systems, people, and facilities. Assets are the focal point of risk scenarios because loss is defined relative to them.

The party accountable for an asset and for the losses it may suffer. In Open FAIR, the asset owner's perspective typically defines primary loss, while secondary loss involves other stakeholders such as regulators or customers.

A safeguard or countermeasure that modifies the frequency or magnitude of loss. In Open FAIR, controls are mapped to specific factors so their effect on risk can be quantified rather than assumed.

The defined boundary of an analysis, specifying which scenarios, assets, and timeframes are included. Clear scoping keeps the analysis tractable and ensures results answer the decision at hand.

Breaking a risk scenario into its constituent factors, such as threat event frequency, vulnerability, and loss components, so each can be estimated separately. It makes complex risk estimable and auditable.

A training process that improves an estimator's ability to assign probabilities that match reality, typically using a series of true-or-false questions with feedback. Calibrated analysts produce more reliable risk inputs.

Using calibrated experts to estimate uncertain risk factors when empirical data is scarce. Experts provide ranges and probabilities, which are then combined in the model rather than treated as precise facts.

The degree of certainty an estimator has in a stated range or probability. Recording confidence helps identify weak inputs and shows where additional data or research would most improve the analysis.

The reliability and relevance of information used to estimate risk factors. Open FAIR analyses should document data sources and quality so decision-makers understand the strength of the conclusions.

Testing how changes in one or more inputs affect the output risk estimate. It identifies which factors most influence results, helping prioritize research and control investments.

A record of identified risk scenarios, their assessed exposure, owners, and treatment status. Open FAIR results can populate a register with quantified loss estimates rather than qualitative ratings alone.

Comparing the expected reduction in probable loss from a control against the cost of implementing it. Open FAIR enables this comparison in financial terms, supporting defensible investment decisions.

Presenting risk analysis results clearly to decision-makers, often using loss exceedance curves and financial ranges. Effective communication connects quantified risk to business objectives and treatment choices.