By quantifying cyber risk in financial terms, Factor Analysis of Information Risk (FAIR™) brings a bottom-line focus to budgeting and spending decisions that just isn’t possible for cybersecurity programs primarily driven by qualitative risk assessment or compliance with frameworks. Here are some of the money-saving benefits of FAIR.
1. Prioritization on Top Risks
This cost-saving is about eliminating wasted effort. As Jack Jones writes in the eBook An Executive’s Guide to Cyber Risk Economics (see page 15), identifying the organization’s top risks and quantifying their loss exposure with FAIR, then ranking them, shows how to most efficiently prioritize spending.
2. Cost/Benefit Analysis
As cybersecurity management decisions arise, running FAIR analysis can give a quick read on the best choice based on return on investment. Read this report from the 2020 FAIR Conference on how the infosecurity team at Ascena Retail demonstrated that placing a new application outside a secure zone would create loss exposure at a level that wouldn’t justify the investment in new compensating controls: FAIR Risk Analysis for Daily Decision Support at Major Healthcare and Retail Organizations.
3. Smart Reacting to Audit Findings
Internal Audit teams can monopolize staff time for IT departments with High-Risk findings of controls or process deficiencies. With FAIR, IT can question whether the risk is indeed High or even a risk at all, based on probable loss exposure. In this case study from RiskLens, High-Risk Audit Finding Doesn’t Hold Up to FAIR Analysis, by translating the audit finding into an FAIR risk scenario, analysts found that the actual probability of a loss event was low and the effectiveness of the controls in place was high, so the risk didn’t really deserve the rating. Learn more: 3 Tips for Making Your IT Audit Job More than Compliance.
4. Define a Cyber Risk Appetite
Many organizations fly blind on this essential guideline for risk management: How much risk will the organization accept? As a result, they may over- or under-invest in cybersecurity. Defining risk appetite is a multi-step process made possible by FAIR analysis which quantifies the probable loss exposure and frequency of loss, giving executive leadership tangible guidance on where to set their limits. Learn more: Define Your Company’s Appetite for Risk with FAIR Analysis.
