preview

The Fair Risk Management Methodology

Decent Essays

One of the most common frame works that is used by risk assessment professionals is the FAIR risk management methodology FAIR stands for Factor Analysis of Information Risk and was first introduced in 2005 by Jack Jones with the goal of being able to provide an answer to two common questions asked by management in relation to risk management which are “how much risk does the organization have” and “how much less risk will there be if we spend the money you propose on mitigation.” The fair risk management methodology is comprised of five steps that allow you to find risk. The first step of the FAIR is the Scenarios. The goal of this step is to identify the asset that is at risk. Once the asset that is at risk has been identified you then develop the possible threats that could impact the asset that is at risk know as a threat community. Once the asset at risk and its potential threat community has been identified you can then move on to step two of FAIR which is calculating the fair factors. In this stage you will analyze and calculate the Threat Event Frequency, Threat Capability and Control Strength for each threat to the asset outlined in the threat community. This in turn will allow you to identify the vulnerability and the loss event frequency for each threat/vulnerability pair. Once you have identify the vulnerability and the loss event frequency for each threat/vulnerability pair you can move on to the third step of the FAIR risk management methodology. The third

Get Access