FAIR (Factor Analysis of Information Risk).

An open international standard for quantifying information and cyber risk in financial terms by decomposing risk into loss event frequency and loss magnitude factors. It belongs to the Compliance & Frameworks category of cybersecurity.

An open international standard for quantifying information and cyber risk in financial terms by decomposing risk into loss event frequency and loss magnitude factors.

FAIR, maintained by the FAIR Institute and standardised by The Open Group (O-RA, O-RT), is the most widely adopted quantitative cyber risk model. It decomposes risk into Loss Event Frequency (threat event frequency multiplied by vulnerability) and Loss Magnitude (primary and secondary losses), each driven by sub-factors that practitioners estimate with calibrated ranges. Tooling such as FAIR-U and commercial platforms typically run Monte Carlo simulations to produce loss distributions, including ALE and loss exceedance curves. FAIR is used to prioritise security investments, support board and regulator discussions, set risk appetite, and underwrite cyber insurance. It is complementary to ISO 31000, NIST RMF, and ERM frameworks.

Defences for FAIR (Factor Analysis of Information Risk) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: FAIR, FAIR analysis.