Risk Quantification with FAIR

Qualitative categories can screen and route risks, but an ordinal label cannot by itself estimate probable loss or compare a control's lifecycle cost with the uncertainty it may reduce. FAIR (Factor Analysis of Information Risk) decomposes a defined loss-event scenario into the probable frequency and probable magnitude of future loss. FAIR is commonly used for financial quantification, although the current model can also support non-financial or qualitative measurement.