Factor Analysis of Information Risk (FAIR) has emerged as the standard Value at Risk (VaR) framework for cybersecurity and operational risk.
The FAIR Institute is a non-profit professional organization dedicated to advancing the discipline of measuring and managing information risk.
It provides information risk, cybersecurity and business executives with the standards and best practices to help organizations measure, manage and report on information risk from the business perspective. The FAIR Institute and its community focus on innovation, education and sharing of best practices to advance FAIR and the information risk management profession.
Sep 13, 2019 9:01:00 AM
Today marks a milestone in FAIR history as NIST has formally published FAIR as an Informative Reference to the NIST CSF, the most widely used cybersecurity framework in the U.S. This means that there is mapping between FAIR and the NIST CSF standard in the sections covering risk analysis and risk management.
Sep 11, 2019 1:48:12 PM
We are very pleased to announce that Douglas W. Hubbard, whose original thinking on measuring risk has been a building block of Factor Analysis of Information Risk (FAIR), will speak at the 2019 FAIR Conference, September 24-25. Doug’s topic “How to Measure Risk with Limited and Messy Data: Overcoming the Myths”
Sep 10, 2019 10:01:34 AM
FAIR Institute President Nick Sanna was among the featured speakers last week at the first annual Cyber Day on the Hill, an event organized to educate Congressional staff members on cutting edge thinking in cybersecurity, both on the national policy level and for protecting their own offices from attack.
Sep 7, 2017 3:18:43 PM
I recently had a conversation with clients around a risk analysis they conducted and noticed as they walked me through it that they seemed to get hung up on the terms “inherent risk” and “residual...Read More >>
Aug 22, 2017 8:00:00 AM
Yes, this is Cyber Risk 101, but risk analysis vs risk assessment is common confusion, so let Jack Jones explain it in an excerpt from his book Measuring and Managing Information Risk: A FAIR ApproachRead More >>
May 1, 2017 8:51:54 AM
The terms “risk appetite” and its close cousin “risk tolerance” are often poorly understood, very rarely used to good effect, and commonly used interchangeably.
Similar to the word “risk,” you will...Read More >>