OpenFAIR 33R

Occurs when a Threat Agent acts against an asset.

Anything that is capable of acting in a manner resulting in harm to an Asset and/or organization

The probable level of force that a Threat Agent is capable of applying against an Asset

The process to comprehend the nature of risk and determine the level of risk.

The story of loss that forms a sentence from the perspective of the Primary Stakeholder.

The probable frequency, within a given timeframe, that a Threat Agent will inflict harm upon an Asset.

The probability that a Threat Agent will act against an Asset once contact occurs.

The person or organization that owns or is accountable for an Asset.

Secondary Losses are always predicated upon a primary loss. (T/F)

The probable magnitude of loss resulting from a Loss Event.

The structured decomposition of how losses materialize when a Loss Event occurs.

Future estimated business losses associated with a diminished competitive position

Occurs when a Threat Agent’s action (Threat Event) is successful in breaching or impairing an Asset.

Individuals or organizations that may be affected by events that occur to assets outside of their control.

Secondary Loss Event Frequency is measured in terms of:

The probable frequency and probable magnitude of future loss.

Any person, policy, process, or technology that has the potential to reduce LEF and/or LM.

The information, information system, or information system component that is breached or impaired by the Threat Agent

Occurs when a Threat Agent establishes a physical or virtual connection to an Asset.

Any agent that is capable of acting against an asset in a manner that can result in harm.

Direct expenditures associated with legal or regulatory actions levied against an organization

What does FAIR stand for?

Coordinated activities to direct and control an organization with regard to risk.

Future estimated business losses associated with an external stakeholder's perception

Direct losses associated with the reduction in an organizations ability to generate its primary value proposition

The overall process of risk identification, risk analysis, and risk evaluation.

The probable frequency within a given timeframe that a threat agent will act against an asset.

Direct expenditures associated with replacing an asset

The subset of the overall threat agent population that shares key characteristics.

Direct expenditures associated with managing a Loss Event

The probable frequency, within a given timeframe, that a Threat Agent will come into contact with an Asset.

The probability that a threat event will become a loss event.

An act taken against an Asset by a Threat Agent. Requires first that contact occurs between the Asset and Threat Agent.