Open FAIR defines risk as the probable frequency and probable magnitude of future loss. Ordinal high, medium or low ratings are a qualitative shortcut, multiplying counts of threats and vulnerabilities mixes unrelated quantities, and the worst case ignores how often loss is likely to occur.
Question 2 of 10 · Risk taxonomy and terminology
What is Probability of Action?
Probability of Action is the probability that a threat agent will act against an asset once contact occurs, driven by factors such as the asset's value to the agent, the effort required and the risk to the agent. The chance a threat event becomes a loss event is Vulnerability, the contact rate is Contact Frequency, and whether a control holds relates to Resistance Strength.
Question 3 of 10 · Risk analysis results
What supports the credibility of FAIR results?
Results are credible when others can see the inputs, the ranges used and the assumptions made, and can challenge or reproduce them. Extra decimal places imply false precision, private assumptions prevent review, and management approval of a heat map does not make the analysis sound.
Question 4 of 10 · The risk analysis process
What should the analyst do when data is limited?
With limited data, the analyst uses calibrated estimates from subject-matter experts, expressed as ranges that reflect the uncertainty, and refines them as data appears. Declining delays decisions, a single guess hides uncertainty, and a borrowed ordinal rating is not an estimate for this scenario.
Question 5 of 10 · Measurement and estimation
Why use most likely values in a distribution?
In a PERT distribution, the most likely value is the analyst's best estimate of the value that occurs most often, and it sets where the distribution peaks. The maximum and minimum set the bounds, and the most likely value need not sit midway between them.
Question 6 of 10 · Basic risk concepts
How does FAIR define risk?
FAIR defines risk as the probable frequency and probable magnitude of future loss, not a qualitative rating.
Question 7 of 10 · Risk taxonomy and terminology
Vulnerability decomposes into which two factors?
Vulnerability compares Threat Capability with Resistance Strength.
Question 8 of 10 · Risk analysis results
Why tie results to loss forms?
Breaking results down by the six forms of loss, such as response or reputation, shows which consequences drive exposure and so where treatment can reduce it. It is not a regulatory requirement, frequency must still be estimated, and the breakdown adds detail rather than reducing results to one figure.
Question 9 of 10 · The risk analysis process
What should the analyst estimate for Loss Magnitude?
Loss Magnitude covers primary loss and, where secondary stakeholders are likely to react, secondary loss, across the six forms of loss. Fines and reputation are only some of those forms, and estimating only the largest possible loss ignores the probable range.
Question 10 of 10 · Measurement and estimation
What is the effect of using ranges on a risk result?
When inputs are ranges, combining them through simulation gives an output that is itself a distribution of possible losses, showing both likely and extreme outcomes. A single figure or color rating discards that information, and a ranking is a later use of results, not the result itself.
0 of 10
Basic risk concepts
Risk taxonomy and terminology
Risk analysis results
The risk analysis process
Measurement and estimation
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.