What is the FAIR Model in Cybersecurity?

FAIR stands for Factor Analysis of Information Risk. It is a framework for cyber risk quantification that helps organizations understand and measure information risks. It is the only international standard quantitative information security and operational risk model.

The FAIR model provides several benefits: 

• Business-oriented communication: FAIR empowers security professionals to express risk in a way business leaders can easily understand - dollars and cents. This facilitates communication and collaboration between these often siloed groups.
• Data-driven decision-making: FAIR enables organizations to prioritize their security efforts. They can focus on addressing the risks that pose the greatest potential financial loss.
• Cost-effective resource allocation: FAIR helps organizations determine how much to invest in cybersecurity controls. They can avoid overspending on mitigating low-impact risks and under-protecting critical assets.

Return to Cyber Risk Quantification Glossary