Open FAIR Foundation cheat sheet

Open FAIR Risk Analysis

• Risk is defined as the probable frequency and probable magnitude of future loss; a risk statement must express both an event and its expected loss.

• The FAIR ontology decomposes risk into Risk (Loss Event Frequency × Loss Magnitude), with Loss Event Frequency = Threat Event Frequency × Vulnerability.

• Vulnerability is the probability that a threat event becomes a loss event, computed as Threat Capability versus Resistance Strength (controls).

• Threat Event Frequency = Contact Frequency × Probability of Action, where Probability of Action reflects adversary intent and perceived value.

• Loss Magnitude = Primary Loss + Secondary Loss; Primary Loss is the direct loss from the event, Secondary Loss is the response and follow-on loss to other stakeholders.

• Primary Loss = Productivity Loss + Response Loss + Replacement Loss; Secondary Loss = Secondary Response Loss + Fines and Judgments + Competitive Advantage Loss + Reputation Loss.

• Risk analysis is decomposed into four sequential stages: identify scenario (scope), analyze factor frequencies, analyze factor magnitudes, then derive and communicate risk.

• The Open FAIR approach estimates frequency and magnitude as distributions (commonly lognormal or PERT/BetaPERT), not as single point values, to express uncertainty explicitly.

• Risk appetite is the amount of risk an organization is willing to accept; risk tolerance is the acceptable deviation around that appetite, and risk decisions compare estimated loss exposure with these thresholds.