Using the FAIR risk-analysis framework to make the business case for security initiatives

Factor Analysis of Information Risk (FAIR) is a framework and risk-analysis process designed to help companies understand how to effectively quantify and assess cybersecurity and operational risks in financial terms. In other words, the framework offers a consistent set of parameters that organizations can use to measure the underlying issues that contribute to security risks, which can help the IT group report risks to leadership in a consistent manner, since threats will be measured against the same set of risk parameters. Ultimately, this helps organizations perform apples-to-apples comparisons of threats and prioritize risks according to their overall risk profile.  

In CohnReznick’s most recent monthly virtual roundtable for chief information security officers (CISOs), the FAIR framework was the main topic of discussion. Participants shared some of their perspectives on and experiences using the framework, which they said can help CISOs more effectively bridge the gaps when IT is speaking about the cost of risks to the business side of a company, giving the two groups a common language.

For example: Security risk assessments should be the starting phase of defining an appropriate security program. For CISOs, however, that can be a mighty tall order. Many organizations are unable to complete a full risk assessment due to a lack of quantitative information, lack of time, or lack of experience in completing such assessments. Complicating matters, organizations often focus on compliance-based risk reduction before considering actual operational risks. This type of approach can yield misleading results and lead to inefficient use of limited resources. 

These were just a few of the challenges that one roundtable participant, a security executive for a large telecom provider, faced as he attempted to procure funding for a corporate security project. The FAIR framework provided a streamlined, effective alternative to a traditional assessment, and kept the focus on operational risk. His company first used the FAIR framework to recast the initiative in financial terms, he explained, with an emphasis on the net present value of the proposed program. At the same time, the telecom provider needed to factor into the cost analysis the monetary value of a potential loss, a consideration that many company stakeholders were reluctant to embrace. In the end, the FAIR framework enabled the CISO to mount a persuasive and effective argument for funding. 

If the telecom’s experience tells us anything about adopting the FAIR framework, it’s that CISOs should be prepared to invest in training on FAIR, change management, and, very often, outside assistance. Also essential is the ability to employ data and security controls that enable organizations to confidently anticipate monetary losses. 

CISOs participating in the roundtable agreed that FAIR framework can be an effective tool for evaluating risk. In particular, participants cited being able to represent the cost of ignoring the threat of ransomware or use of encryption controls as use cases for FAIR. 

However, they also expressed reservations about the relevance of the framework in cases in which losses are more qualitative than quantitative, as well as situations in which adequate data for reputational damage or brand loss do not exist. 

CohnReznick believes that the FAIR framework is a valuable tool in a firm’s risk analysis toolkit that can enable CISOs to justify specific investments in risk mitigation efforts.