Open FAIR Risk Taxonomy and Ontology
What the domain tests
Taxonomy and ontology questions test structure: how FAIR factors relate, which level a term belongs to, and how to build a consistent model without mixing categories.
Core structure
- Top level: risk = f(LEF, LM).
- LEF branch: TEF (Contact Frequency, Probability of Action) and Vulnerability (Threat Capability, Resistance Strength).
- LM branch: Primary Loss and Secondary Loss, each expressed through the six loss forms.
- Context: asset, threat community, control, risk landscape, and timeframe.
- Controls affect factors: preventive controls affect TEF or vulnerability; detective and corrective controls affect loss magnitude and secondary loss.
Worked example
Customer PII sits in a cloud store; the threat community is external attackers; the effect is a confidentiality breach. Contact Frequency is 20 probes per year; Probability of Action is 0.5; TEF = 10. Threat Capability exceeds Resistance Strength in 30% of cases; LEF = 3. Primary loss is response and replacement at $400,000; secondary loss is fines and reputation at $600,000; LM = $1,000,000. Each factor stays at its own ontology level; controls are not inserted as risk factors.
Traps
Mixing threat event and loss event; putting control effectiveness in the loss branch; counting the same cost as both primary and secondary; treating a threat community as one attacker; using the ontology as a checklist without linking dependencies.