FAIR (Factor Analysis of Information Risk)
Definition
A quantitative risk framework standardised by The Open Group (Open FAIR) that decomposes risk into Loss Event Frequency and Loss Magnitude, each further decomposed into sub-factors. Uses probability distributions rather than point estimates, producing a range of probable outcomes.
- Standardising body
- The Open Group (Open FAIR)
- Core decomposition
- Loss Event Frequency and Loss Magnitude
- Approach
- Quantitative, probability distributions rather than point estimates
- Output
- A range of probable outcomes
Common questions
How does FAIR differ from a qualitative risk matrix (high/medium/low)?+
A qualitative matrix assigns subjective labels that are hard to compare or aggregate across an organization, whereas FAIR decomposes risk into measurable sub-factors and expresses results as probability ranges, which lets an analyst communicate risk in terms decision-makers can weigh against actual financial exposure.
Where does FAIR fit in a digital forensics or incident response engagement?+
After an incident, FAIR's decomposition can help quantify the probable loss magnitude of a breach for legal, insurance, or reporting purposes, translating technical findings about vulnerability exploitation and data exposure into the frequency and magnitude terms the framework uses.
Related terms
- ALE (Annualised Loss Expectancy)
- The expected monetary loss from a specific threat over a one-year period. Calculated as: ALE = SLE x ARO (Annualised Rate of...
- Qualitative Risk Assessment
- A methodology that rates likelihood and impact on descriptive or ordinal scales (such as 1-5 or low/medium/high) and combines them in a...
- Quantitative Risk Assessment
- A methodology that assigns monetary values to threat scenarios using metrics such as asset value, exposure factor, SLE, ARO, and ALE. Outputs...
- Risk Appetite
- The amount and type of risk an organisation is willing to accept in pursuit of its objectives, as defined by its governing...
- SLE (Single Loss Expectancy)
- The expected monetary loss from a single occurrence of a specific threat event against a specific asset. Calculated as: SLE = Asset...