thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Advanced

Factor Analysis of Information Risk (FAIR)

Open quantitative model that decomposes risk into loss event frequency and loss magnitude for financial analysis.

Definition

FAIR, maintained as an Open Group standard (O-RA and O-RT), breaks risk into loss event frequency (threat event frequency and vulnerability) and loss magnitude (primary and secondary loss). Analysts use calibrated ranges and Monte Carlo simulation to produce a distribution of annualized loss. It enables risk to be communicated in financial terms to executives.

Example

A FAIR analysis estimates a 90 percent confidence range of $300,000 to $2.1 million annual loss from a cloud data breach.

Exam tip

FAIR is quantitative and probabilistic; contrast it with qualitative matrices.

Related terms