Key Facts
- Regulator
- The Open Group (Security Forum), which publishes the Open FAIR standards O-RA and O-RT.
- Latest version
- The Open Group Risk Analysis (O-RA) Standard, Version 2.1, a companion to the Risk Taxonomy (O-RT) Standard, Version 3.1. It supersedes O-RA 2.0.1.
- Effective
- 22 May 2025
- Official text
- www.opengroup.org ↗
What is Factor Analysis of Information Risk (FAIR)?
Factor Analysis of Information Risk (FAIR) is a quantitative method for analysing information risk. The Open Group's Security Forum publishes it as the Open FAIR standards, a risk taxonomy and an analysis process. It is voluntary, and any organisation can use it to analyse a risk scenario in a consistent, comparable way.
The current versions are the Open Group Risk Analysis (O-RA) Standard, Version 2.1, and its companion, the Risk Taxonomy (O-RT) Standard, Version 3.1. The Open Group published O-RA 2.1 and O-RT 3.1 on 22 May 2025, replacing O-RA 2.0.1 and O-RT 3.0.1. Together they make up Open FAIR.
The two standards divide the work. O-RT provides a standard definition and taxonomy for information security risk, along with guidance on using the taxonomy. O-RA describes the process analysts follow when they run an analysis.
A risk register that says "high" has described a feeling, not a risk.
Why it matters
The board asks how much cyber risk the firm is carrying. The register answers in red, amber and green, and the conversation stalls there.
FAIR exists to change that answer. It is a quantitative risk analysis methodology, so a scenario is analysed against a defined taxonomy rather than scored by instinct. Two analysts using the same taxonomy are at least describing risk in the same terms.
The Open FAIR standards can be applied to any risk scenario, so results can be normalised across risk domains. Cyber risk can then be set beside other risks on the same footing, which is the comparison a board is usually trying to make.
There is a second reason. The Open Group says practitioners who must carry out IT risk assessments for other standards and regulations can use the Open FAIR taxonomy and framework to do them. FAIR is a way of doing the assessment, not one more thing to be assessed against.
A number nobody can trace to a method is a guess with a decimal point.
Who it applies to
FAIR is voluntary: no regulator mandates it. An organisation adopts it as a choice of method, not as a condition of any scheme.
It suits risk, security and GRC teams that need to analyse specific risk scenarios consistently. FAIR has no control set, so a firm that does not run formal risk analysis has nothing to adopt.
There is no FAIR certificate for a company. The Open Group certifies individuals, not organisations.
FAIR does not replace ISO 27001. An ISO 27001 certificate shows you run a management system; FAIR is a method you can use inside the risk assessment that system requires. For that requirement, see ISO 27001 Clause 6.1 in the ISO 27001 vault.
The UK position
A UK firm rarely meets FAIR as a requirement. No UK law or regulator names it in the sources we checked. A UK firm meets FAIR by choice: a risk team adopts it, or an analyst trained in it brings it to the job.
Key requirements
FAIR has no compliance requirements to evidence. Its substance is two standards and the way they fit together.
- The risk taxonomy (O-RT 3.1). A standard definition and taxonomy for information security risk, plus information on how to use it. It gives analysts shared terms before they start measuring.
- The analysis process (O-RA 2.1). The process analysts follow to carry out a risk analysis using that taxonomy.
- Scenario-based scope. The standards apply to any risk scenario, which is what allows results to be normalised across risk domains.
- Layering on other frameworks. Open FAIR is used alongside other frameworks, not instead of them. The Open Group's cookbooks describe how to apply it to ISO/IEC 27005:2008 and to the NIST Cybersecurity Framework.
- Individual certification. The Open FAIR Certification for People programme, aimed at risk analysts, validates a person's knowledge of the Open FAIR Body of Knowledge.
Frequently asked questions
Open FAIR is the standard itself: The Open Group's Security Forum publishes it as the O-RA and O-RT standards. The FAIR Institute is a separate body that promotes FAIR; it does not publish the standard. The two names are easy to confuse, so when a customer or auditor cites FAIR, The Open Group's publications are the primary text to check.
No. Factor Analysis of Information Risk is voluntary, and no regulator mandates it. Where a regulation or standard does require a risk assessment, FAIR is one method an organisation can choose for it. The duty is the assessment, not the method, so a firm that uses FAIR still answers to the requirement that asked for the assessment.
No. Open FAIR certification is for people, not organisations. The Open Group aims its Certification for People programme at risk analysts and uses it to validate knowledge of the Open FAIR Body of Knowledge: its terms, structure and core risk analysis principles. A company can employ certified FAIR analysts, but it cannot hold a FAIR certificate itself.
ISO 27001 requires a defined, repeatable risk assessment process but leaves the choice of method to the organisation. FAIR can be that method, or the part of it used where a scenario needs a number rather than a rating. FAIR adds no controls, and an ISO 27001 auditor still assesses the risk process against the standard's own requirements.
The current Open FAIR standards are O-RA 2.1 and O-RT 3.1, published together on 22 May 2025. Some Open Group pages still list O-RA 2.0.1 and O-RT 3.0.1, and the Open FAIR 2 Foundation certification is based on those earlier versions. When a questionnaire or contract cites a FAIR version, check it against The Open Group's publication record.