Open FAIR Foundation key terms

The probable frequency and probable magnitude of future loss, expressed as a distribution rather than a single number. It combines how often a loss event may occur with how much loss it may cause.

The process of identifying and quantifying the frequency and magnitude of future loss. In Open FAIR it produces a defensible, calibrated estimate using defined factor categories, often as a probability distribution.

The broader activity that pairs risk analysis with evaluation, comparing analyzed risk against defined tolerance criteria. It answers both what the risk is and whether it is acceptable to the organization.

The coordinated set of decisions and controls used to modify risk to a level the organization accepts. It follows analysis and evaluation, and it is judged by whether risk is brought within tolerance.

The deliberate choice among options such as avoiding, reducing, transferring, or accepting a risk. Each option should be justified by how it changes frequency or magnitude relative to cost.

The amount of risk an organization is willing to accept in pursuit of its objectives, often stated as a threshold or range. It provides the reference point used to judge whether a risk must be treated.

The general, high-level willingness of an organization to take on risk, set by leadership. It frames more specific tolerance thresholds used in individual risk decisions.

An incident in which a threat agent acts on an asset and causes harm of some kind. Frequency of such events is one of the two quantities Open FAIR analysis estimates.

An action or circumstance in which a threat agent harms an asset, whether deliberately or accidentally. Its estimated frequency per unit time is a core input to risk calculation.

Any actor or force with the potential to harm an asset, including malicious people, accidental insiders, and natural forces. Open FAIR categorizes agents by motivation, capability, and contact with the asset.

A group of threat agents sharing similar characteristics, such as skills, resources, and intent. Analysts assess each relevant community separately because their behavior and capability differ.

The level of force or skill a threat agent can bring to bear against an asset's resistance. It is compared with resistance strength to determine how often attempts succeed.

How often a threat agent encounters or attempts to interact with an asset in a given period. It is one component used to derive how often a threat event actually occurs.

The likelihood that a threat agent who has contact with an asset chooses to act against it. Motivation and perceived benefit influence this value, which scales contact frequency into event frequency.

The estimated rate at which threat events occur against an asset over a defined period. It is commonly derived from contact frequency, probability of action, and the success of attempts.

The probability that a threat event becomes a loss event, given the asset's resistance versus the agent's capability. It bridges threat activity and actual harm in the analysis chain.

The ability of an asset or its controls to withstand a threat agent's force. Higher resistance lowers the chance that an attempt succeeds, reducing vulnerability.

The estimated rate at which loss events occur over a defined period, usually per year. It results from combining threat event frequency with vulnerability.

The amount of harm caused by a single loss event, expressed in monetary terms. It aggregates primary and secondary loss components and is the second key factor in risk.

The direct harm an organization suffers from a loss event, such as response costs, lost productivity, or replacement expense. It is incurred by the affected party itself.

Harm that falls on parties other than the primary victim and later affects the organization, such as fines, lawsuits, or reputation damage. It depends on who else is affected and how they react.

An outside party, such as a regulator, customer, or partner, that may suffer loss or react to an incident. Their responses drive secondary loss for the organization.

The likelihood that a secondary stakeholder reacts to a primary loss event in a way that causes further loss. It scales secondary loss magnitude.

Something of value to the organization that a threat agent could harm, such as data, systems, people, or facilities. Assets are the focal point of any Open FAIR analysis.

A safeguard or countermeasure intended to reduce risk, typically by lowering loss event frequency or loss magnitude. Controls should be evaluated by their effect on those factors versus their cost.

A training and assessment process that improves a person's ability to give accurate probability estimates, typically using confidence intervals and scored quizzes. It supports credible subjective estimates in risk analysis.

A person with deep knowledge of a specific area who supplies estimates for factors such as threat capability or control effectiveness. Their estimates are calibrated and combined with others.

The act of assigning values or ranges to analysis factors, often under uncertainty. Good practice records ranges and confidence rather than single-point guesses.

A mathematical description of the likelihood of different values for a variable. Open FAIR uses distributions to express uncertainty in frequency and magnitude inputs and outputs.

A computational method that repeatedly samples from input distributions to produce a distribution of possible outcomes. It is used to combine frequency and magnitude factors into a risk result.

A range of values, with an associated level of confidence, within which an estimate is expected to fall. It communicates uncertainty around an estimated factor or result.

A single value used to represent an uncertain quantity, such as a most likely annual loss frequency. It is simpler than a distribution but hides uncertainty.

A technique that tests how changes in one input affect the overall risk result. It helps identify which factors most influence outcomes and where to focus controls or data collection.

A defined combination of an asset, a threat community, and a loss event that is analyzed as a unit. Scenarios scope the analysis and keep estimates consistent.

A structured record of identified risks, their analyses, owners, and treatment status. It supports tracking and communication across the risk management cycle.

An approach that describes risk using labels or ordinal scales, such as high, medium, or low. It is faster but less precise than quantitative methods and harder to aggregate.

An approach that expresses risk in numerical, often monetary, terms with explicit uncertainty. Open FAIR is designed to support this kind of analysis.

The expected monetary loss from a risk over one year, often computed from loss event frequency times loss magnitude. It is a summary statistic, not a full distribution.

The process of conveying analysis results, assumptions, and uncertainty to decision makers in a form they can act on. Clear communication is essential for defensible risk decisions.