FAIR Cyber Risk Quantification

Available on: Starter and above

What is FAIR?

FAIR (Factor Analysis of Information Risk) is an international standard developed by The Open Group for quantifying cyber risk in financial terms. Rather than rating risks on abstract 1–5 likelihood/impact scales, FAIR converts those inputs into dollar-denominated loss estimates — the language boards, CFOs, and risk committees actually use to make decisions.

When a risk register says a threat is "High," executives have no basis to compare it against other business risks or decide how much to spend on a control. When you can say "this risk has an expected annual loss of $2.3M," the conversation changes entirely.

Key FAIR Concepts

LEF — Loss Event Frequency

How often, in a given year, the risk is likely to materialize. LEF is expressed as a range: minimum, most likely, and maximum events per year. For example, a ransomware scenario for a mid-size healthcare org might have a LEF of 0.05 (min) / 0.2 (likely) / 0.5 (max) — meaning somewhere between once every 20 years and twice every 3 years.

LM — Loss Magnitude

The dollar amount lost when the event occurs. Like LEF, LM is expressed as a range. Loss magnitude includes both primary and secondary losses:

• Primary Loss: direct financial impact — recovery costs, legal fees, regulatory fines, breach notification costs, forensic investigation, ransomware payments
• Secondary Loss: indirect impact — reputational damage, customer churn, stock price decline, increased insurance premiums, executive time diverted

ALE — Annualized Loss Expectancy

ALE = LEF × LM

This is the primary output of a FAIR analysis. ALE represents the average dollar loss per year if this risk goes unmitigated. An ALE of $500K means you'd expect to lose $500,000 per year on average over time from this specific risk scenario.

Using FAIR in CMDash

FAIR quantification is available on any risk in the Risk Register.

To quantify a risk:

1. Go to Risk Register
2. Open any risk record
3. Click the Quantify with FAIR tab
4. Enter your LEF inputs: minimum, most likely, and maximum events per year
5. Enter your LM inputs: minimum, most likely, and maximum loss amount (in dollars)
6. Click Calculate — CMDash computes ALE using the FAIR standard methodology

Monte Carlo Simulation (Planned Feature)

A planned enhancement will run Monte Carlo simulation across your LEF and LM ranges, generating a full probability distribution of outcomes. Instead of a single ALE number, you'll see the 10th/50th/90th percentile loss scenarios — useful for communicating confidence intervals to boards and insurers.

Interpreting FAIR Results

Using ALE to justify security investment

FAIR makes the ROI of security controls calculable:

When you can show a $600K annual risk reduction from a $60K control, the budget conversation becomes straightforward.

Prioritizing remediation spend

Compare ALE across risks in your register to direct remediation dollars toward the scenarios with the highest expected financial impact. A risk with ALE of $1.5M should generally be prioritized over a risk with ALE of $80K — even if both were scored "High" on a traditional 1–5 scale.

Choosing Your FAIR Inputs

The quality of your FAIR output depends on the quality of your inputs. Good sources for each component:

For LEF (frequency):

• Your own incident history (most accurate for your org)
• Industry incident rate data from the Verizon Data Breach Investigations Report (DBIR)
• Threat intelligence from your EDR or MSSP
• CMDash's peer benchmarking data (available at Enterprise), which shows incident rates for your industry segment

For LM (loss magnitude):

• IBM Cost of a Data Breach Report — annual publication with per-record and per-incident averages by industry and breach type
• Verizon DBIR loss data
• Your cyber insurance carrier's actuarial data
• Legal and regulatory fee estimates from counsel familiar with your jurisdiction and applicable regulations (HIPAA, GDPR, CCPA, etc.)

Starting ranges when you have limited data:

• Use conservative (wide) ranges: if you're uncertain, let min and max span a full order of magnitude
• FAIR acknowledges uncertainty; a wide range is more honest than a false-precision point estimate
• Document your assumptions — auditors and board members may ask

Exporting FAIR Data

When FAIR values are populated on a risk, the Risk Register export includes FAIR columns:

• fair_lef_min, fair_lef_likely, fair_lef_max
• fair_lm_min, fair_lm_likely, fair_lm_max
• fair_ale

Export via Risk Register → Export → CSV / Excel.

Board Presentation Integration

FAIR output integrates into the Board Deck [Command+] under the Risk Quantification slide. The slide displays your top risks with their ALE values alongside traditional risk scores, giving boards a financially anchored view of your risk portfolio.

See the Board & Executive Reporting guide for details on generating and configuring board decks.

Common Questions

Do I need a FAIR certification to use this?

No. CMDash's FAIR implementation handles the methodology. Familiarity with the basic concepts (LEF, LM, ALE) is sufficient to use the feature effectively. If you want to go deeper, The Open Group offers FAIR training and the FAIR Institute (fairinstitute.org) publishes free resources.

How accurate are the estimates?

FAIR estimates are as accurate as the inputs. The goal is not a precise prediction — it's a defensible, structured approximation that's more useful than ordinal scoring. A FAIR analysis that says "expected loss is somewhere between $200K and $2M, most likely around $700K" is far more actionable than "High risk."

Can I model mitigated vs. unmitigated scenarios?

Yes. Create two FAIR analyses on the same risk: one with current LEF/LM values (unmitigated), and one with projected LEF/LM after a proposed control is implemented. The difference in ALE is the annualized value of the control. Use this to build a business case for security investment.

Related Features

• Risk Register
• Board & Executive Reporting