Open FAIR Risk Analysis Concepts and Terminology
What the domain tests
The concepts domain checks whether you can use Open FAIR vocabulary precisely: risk, frequency, magnitude, loss event, threat event, vulnerability, asset, threat community, and control. The exam expects definitions that fit the ontology, not loose business usage.
Core rules
- Risk is the probable frequency and probable magnitude of future loss. It is not a threat, a vulnerability, or a certainty.
- Frequency chain: Loss Event Frequency (LEF) = Threat Event Frequency (TEF) x Vulnerability. TEF is driven by Contact Frequency and Probability of Action.
- Vulnerability = f(Threat Capability, Resistance Strength). A control usually changes one of these factors, not risk directly.
- Loss Magnitude (LM) = Primary Loss + Secondary Loss. Six loss forms apply: productivity, response, replacement, fines and judgments, competitive advantage, reputation.
- Risk appetite is the amount and type of risk an organization is willing to accept; risk tolerance is acceptable variation around that appetite.
Worked example
A ransomware scenario has TEF 12 attempts per year and vulnerability 0.25, so LEF = 3 events per year. If average loss magnitude is $200,000, annualized loss exposure is $600,000. The reasoning is chain-based: attempts are not losses until vulnerability is applied, and magnitude should include secondary response and reputation costs, not only ransom.
Traps
Do not call a vulnerability risk. Do not multiply TEF by LM and skip vulnerability. Do not add TEF and LEF. Do not use ALE as a substitute for a distribution when uncertainty is material. Do not confuse risk appetite with risk tolerance.