Open FAIR 2 Foundation study plan

Define each element of the Open FAIR risk taxonomy (asset, threat community, threat agent, loss event, primary/secondary loss, risk) in your own words

Distinguish between primary and secondary loss and give two examples of each

Map the six ontology components (asset, threat, event, loss, impact, risk) to a real-world scenario

Explain how the taxonomy supports consistent risk communication across an organization

Describe the relationship between risk, loss event frequency, and loss magnitude using the Open FAIR definition

List the factors that drive loss event frequency (threat event frequency and vulnerability)

List the factors that drive loss magnitude (primary loss and secondary loss)

Explain how the taxonomy connects to the analysis process without confusing ontology with method

Define key Open FAIR terminology: risk, uncertainty, probability, likelihood, confidence, and calibration

Explain the difference between risk and uncertainty and why Open FAIR treats risk as a distribution

Describe the role of subject-matter experts and calibrated estimation in risk analysis

Identify common misconceptions about risk (e.g., risk as a single number) and correct them

Outline the steps of the Open FAIR risk analysis process from scoping to communication

Explain the purpose of each step and the inputs and outputs of each

Describe how to define and bound a risk scenario using the taxonomy

Identify the roles and responsibilities of the analyst, stakeholders, and subject-matter experts in the process

Apply the Open FAIR process to a simple risk scenario from start to finish

Estimate loss event frequency and loss magnitude ranges using calibrated estimation techniques

Document assumptions and data sources for each estimate

Explain how to validate and challenge estimates during analysis

Translate Open FAIR analysis results into risk statements suitable for decision-makers

Compare risk analysis results against risk tolerance and appetite

Describe how to prioritize risks and select treatments based on analysis output

Explain how to communicate uncertainty and confidence to non-technical audiences

Evaluate how Open FAIR supports risk-informed decision-making in different contexts (e.g., investment, control selection)

Identify limitations of the method and common pitfalls in applying it

Explain how to integrate Open FAIR results with other risk frameworks without conflating methods

Review terminology and concepts from Domain 1 through the lens of decision support

Review all domains using a self-made summary sheet of key concepts and process steps

Complete a timed practice exam or set of scenario-based questions covering all domains

Identify weak areas from practice results and revisit those topics

Rehearse explaining the Open FAIR ontology and process to a colleague in under 10 minutes