Factor Analysis of Information Risk (FAIR^TM) was conceived as a way to provide meaningful measurements so that it could satisfy management's desire to make effective comparisons and well-informed decisions. The FAIR^TM quantitative risk analysis model has become the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

• FAIR^TM provides a model for understanding, analyzing and quantifying information risk in financial terms.
• It is unlike risk assessment frameworks that focus their output on qualitative color charts or numerical weighted scales.
• It builds a foundation for developing a robust approach to information risk management.

FAIR's risk model components are specifically designed to support risk quantification:

• Assess cyber risk financially: Understand your cyber risk from the business perspective and communicate with the Board and Executive teams in a language that everybody understands
• Prioritize remediation efforts: Prioritize risk mitigation initiatives based on their capacity to reduce business risk. Optimize your cybersecurity budgets.
• Justify security investments and demonstrate ROI: Drive security investments by demonstrating their impact against risk. Demonstrate program effectiveness by tracking changes to risk overtime.
• Meet growing regulatory pressures: Respond to the growing drum beat of regulators demanding that cyber risk assessments be articulated in financial terms.