FAIR stands for Factor Analysis of Information Risk. Simply stated, it is a model that describes what risk is, how it works and how to quantify it.

FAIR is the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

Unlike risk assessment standards that focus their output on qualitative color charts or numerical weighted scales, the FAIR model specializes in financially derived results tailored for enterprise risk management.

FAIR is widely used by organizations in a variety of sectors, including:

• Banking
• Insurance
• Retail
• Manufacturing
• High Tech
• Health Care
• Energy
• Education
• Consultancies
• Government

Organization size ranges from SMB to Fortune 1. Overall, understanding and measuring risk can be useful for organizations of any size in any industry.

For any framework to be useful, an organisation must support its use and implementation. If the management and decision makers are only interested in compliance with regulations and/or “best practices” and is not interested in understanding how much risk exists, how much risk is associated with non-compliance issues, or which risk management measures are likely to be the most cost-effective, then an analytic framework like FAIR may not be a good fit.

Logically, the effects of damaged reputation have to materialize in some form of tangible loss or else we wouldn’t care. For a commercial enterprise, these effects materialize as reduced market share, decreased stock price (if publicly traded), and potentially the cost of capital. In the public sector, an organization's goal might be stated in terms of mission delivered and service offered and not necessarily in terms of financial goals. In these cases, reputation damage can be assessed in financial terms using subject matter estimates, expressed in ranges.

The key is to get these loss estimates from business or agency executives, as it is extremely uncommon for information security or risk analysts to estimate these effects accurately.

The short answer is “No”, it’s not true. Unfortunately, there are a lot of commonly held misconceptions about risk, particularly in the cybersecurity profession. More information about some of the most commonly expressed concerns can be found in the FAIR Book (Measuring and Managing Information Risk: a FAIR approach)

Anywhere you have a need to know how much risk exists (or could exist if…). Examples include:

• Policy exception requests
• Audit findings
• Penetration test results
• Comparing risk issues. For example, “Does data leakage or web application security represent more risk to our organization?”
• Building a business case for new security measures or for defending existing security expenditures.
• Prioritizing risk mitigation options when the budget doesn’t allow for everything. For example, “Which is likely to be more cost-effective, training my web developers or implementing an application firewall?”
• Optimizing cyber insurance coverage.

Organization size ranges from SMB to Fortune 1. Overall, understanding and measuring risk can be useful for organizations of any size in any industry.

Our Cyber Risk Quantification training and certification will be live soon. If interested, please fill the interest form and we shall reach out shortly.