Open FAIR Foundation study plan

Define the six factors of the Open FAIR risk taxonomy (asset, threat community, threat effect, vulnerability, loss event frequency, loss magnitude) in your own words without notes

Distinguish risk from loss event frequency and loss magnitude, and explain why risk is expressed as a distribution rather than a single number

Map the Basic FAIR ontology layers (risk, loss event, frequency, magnitude, and their sub-factors) into a one-page diagram

Identify each factor's role in the loss event chain from threat action through asset loss

Explain Loss Event Frequency as the product of Threat Event Frequency and Vulnerability, and state how each input is estimated

Describe Threat Event Frequency in terms of contact frequency and probability of action

Describe Vulnerability in terms of threat capability versus resistance strength

Calculate a simple LEF estimate from given contact frequency, probability of action, and vulnerability inputs

Break Loss Magnitude into primary and secondary loss, and list the six forms of loss (productivity, response, replacement, fines and judgments, competitive advantage, reputation)

Explain how secondary stakeholder losses are triggered by primary loss events

Estimate loss magnitude ranges for a data breach scenario using the six forms of loss

Explain why ranges and calibrated estimates are preferred over point values in Open FAIR analysis

Explain the purpose and structure of the Open FAIR Body of Knowledge and how its taxonomy supports consistent risk communication

Describe the risk analysis process steps: scoping, factor identification, estimation, and results presentation

State the difference between Open FAIR as a taxonomy, an ontology, and a methodology

Identify common pitfalls such as double counting, mixing risk with controls, and confusing asset value with loss magnitude

Explain what calibrated probability estimation means and why calibration training matters in Open FAIR

Describe techniques for eliciting ranges from subject matter experts, including the equivalent bet test concept

Identify sources of bias that distort estimates and how decomposition reduces them

Practice producing a calibrated range for a familiar, verifiable quantity and check the outcome

Explain how Open FAIR results feed risk treatment decisions, including comparing risk against tolerance

Describe how to express analysis results for business stakeholders without losing the probabilistic meaning

Distinguish risk analysis from risk treatment and risk monitoring in the FAIR context

Interpret a risk distribution and articulate what a given percentile of loss exposure means

Run a complete end-to-end Open FAIR analysis on a new scenario, from scoping through factor estimation to result

Justify each estimate with a stated rationale and confidence level

Check the analysis for internal consistency between LEF, vulnerability, and loss magnitude inputs

Identify which assumptions would most change the result if wrong

Review the full taxonomy and process, closing gaps identified in earlier weeks

Recite definitions of all key Open FAIR terms from memory

Re-derive the LEF and loss magnitude relationships without reference materials

Explain the value and limits of Open FAIR to a hypothetical colleague in under two minutes