ExamFinch.com My Study

Study guide

7.2 Quantitative Risk Analysis & FAIR Framework

Practice this exam

Certified in Risk and Information Systems Control CRISC

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Exam Overview & Risk Foundations

1.1 About the CRISC Exam 1.2 Exam Day Strategy & Question Analysis

2 Chapter 2: Enterprise Governance & Organizational Strategy

2.1 Enterprise Governance of IT & Strategic Alignment 2.2 Organizational Structures, Roles & RACI Matrix 2.3 The Three Lines Model & Assurance Coordination 2.4 Legal, Regulatory & Contractual Compliance

3 Chapter 3: Risk Governance Frameworks & ERM

3.1 Enterprise Risk Management Frameworks 3.2 Risk Appetite, Tolerance & Capacity 3.3 IT Risk Strategy Alignment with Business Objectives

4 Chapter 4: Risk Culture, Ethics & Policy Architecture

4.1 Risk Culture, Tone at the Top & Accountability 4.2 Ethics, Integrity & ISACA Code of Professional Ethics 4.3 Risk Policy, Standards, Guidelines & Procedures Architecture

5 Chapter 5: Asset Management & Business Resilience Governance

5.1 Asset Identification, Valuation & Data Classification 5.2 Data Ownership, Custodianship & Governance Roles 5.3 Business Resilience Governance & Strategic Alignment 5.4 Data Privacy Governance & Global Mandates

6 Chapter 6: IT Risk Identification & Threat Modeling

6.1 Risk Identification Techniques 6.2 Threat Landscape Analysis, Threat Actors & Attack Vectors 6.3 Vulnerability Assessment & Exposure Analysis 6.4 Risk Scenario Development & Threat Modeling

7 Chapter 7: Risk Analysis Methodologies & Evaluation

7.1 Qualitative Risk Analysis & Risk Matrices 7.2 Quantitative Risk Analysis & FAIR Framework 7.3 Semi-Quantitative Analysis & Monte Carlo Simulation 7.4 Risk Evaluation, Ranking & Prioritization Criteria

8 Chapter 8: Risk Register, Aggregation & BIA Integration

8.1 Risk Register Architecture, Maintenance & Lifecycle 8.2 Risk Aggregation, Correlation & Interdependencies 8.3 Business Impact Analysis (BIA) Integration

9 Chapter 9: Risk Treatment Strategies & Cost-Benefit Analysis

9.1 Risk Response Options 9.2 Cost-Benefit Analysis & Return on Security Investment (ROSI) 9.3 Developing & Implementing Risk Action Plans 9.4 Managing Residual Risk & Secondary Risk

10 Chapter 10: Control Design, Selection & Assessment

10.1 Control Types & Categories 10.2 Control Design Principles & Defense-in-Depth 10.3 Testing Control Design & Operating Effectiveness 10.4 Remediation of Control Deficiencies & Exceptions

11 Chapter 11: Third-Party & Supply Chain Risk Management

11.1 Third-Party Risk Management Lifecycle & Due Diligence 11.2 Vendor Contracts, SLAs & Right-to-Audit Clauses 11.3 Supply Chain Risk Management & Software Bill of Materials (SBOM) 11.4 Cloud Service Provider Governance & Shared Responsibility

12 Chapter 12: Risk Monitoring, KRIs & Executive Reporting

12.1 Key Risk Indicators (KRIs), Thresholds & Triggers 12.2 Aligning KRIs with KPIs & Business Performance Metrics 12.3 Stakeholder Risk Reporting & Governance Communication 12.4 Continuous Risk Monitoring & Automated Telemetry

13 Chapter 13: Enterprise IT Architecture & Operations

13.1 Enterprise Architecture & IT Governance Alignment 13.2 Cloud Computing & Virtualization Architecture Risk 13.3 Systems Resilience, High Availability & Infrastructure Redundancy 13.4 Technology Roadmaps, IT Portfolio & Project Risk Governance

14 Chapter 14: Information Security Principles, IAM & SSDLC

14.1 Information Security Principles & The CIA Triad 14.2 Identity & Access Management (IAM), PAM & RBAC 14.3 Cryptography, Encryption & Key Management (KMS) 14.4 Secure Software Development Lifecycle (SSDLC) & DevSecOps

15 Chapter 15: Incident Response, Resilience & Emerging Tech Risk

15.1 Incident Response Lifecycle & Containment Strategies 15.2 Business Continuity & Disaster Recovery Planning and Testing 15.3 Emerging Technologies Risk (AI/LLM, Quantum, IoT/OT) 15.4 Risk Program Maturity Assessment & Continuous Improvement

7.2 Quantitative Risk Analysis & FAIR Framework

Key Takeaways Explain This Topic AI

Quantitative risk analysis assigns verifiable monetary and numerical values to risk components, calculating financial loss exposure such as Annualized Loss Expectancy (ALE = SLE x ARO).

Single Loss Expectancy (SLE) represents the monetary loss from a single risk event, calculated as Asset Value (AV) multiplied by Exposure Factor (EF).

Cost-Benefit Analysis (CBA) justifies control investments by proving that the reduction in annual loss expectancy (ALE before minus ALE after) exceeds the annualized cost of the safeguard.

The Factor Analysis of Information Risk (FAIR) framework decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM), establishing an international standard ontology for cyber risk quantification.

Loss Magnitude in FAIR is divided into Primary Loss (direct asset damage, response costs, productivity loss) and Secondary Loss (regulatory penalties, customer churn, legal judgments).

Last updated: August 2026

7.2 Quantitative Risk Analysis & FAIR Framework

While qualitative analysis categorizes risk using descriptive labels, quantitative risk analysis expresses risk in objective, verifiable financial figures and empirical metrics. By translating technical vulnerabilities into monetary loss projections (e.g., dollars, euros, or yen), quantitative analysis enables business leaders to evaluate security investments using traditional corporate financial methodologies, such as Cost-Benefit Analysis (CBA) and Return on Security Investment (ROSI) .

1. Classic Quantitative Risk Formulas & Metrics

The ISACA CRISC exam rigorously tests the core mathematical relationships governing classical quantitative risk assessment: +-----------------------------------------------------------------------------+

  • | CLASSICAL QUANTITATIVE RISK FORMULAS |
  • | |
  • | 1. SINGLE LOSS EXPECTANCY (SLE): |
  • | SLE = Asset Value (AV) x Exposure Factor (EF) |
  • | |
  • | 2. ANNUALIZED LOSS EXPECTANCY (ALE): |
  • | ALE = Single Loss Expectancy (SLE) x Annualized Rate of Occurrence (ARO)|
  • | ALE = (AV x EF) x ARO |
  • | |
  • | 3. COST-BENEFIT ANALYSIS (CBA) / NET ANNUAL BENEFIT: |
  • | Net Annual Benefit = (ALE_current - ALE_mitigated) - Annual_Control_Cost|
  • +-----------------------------------------------------------------------------+

Detailed Variable Definitions:

Asset Value (AV): The comprehensive financial worth of the asset to the organization. This includes replacement cost, hardware/software acquisition, intellectual property value, data reconstruction labor, and business revenue generated by the asset.

Exposure Factor (EF): A percentage (ranging from 0% to 100%, expressed as 0.0 to 1.0) representing the proportion of asset value destroyed or lost during a single realized risk event.

Single Loss Expectancy (SLE): The total financial loss incurred by the organization each time the specific risk event occurs ($ Amount).

Annualized Rate of Occurrence (ARO): The estimated frequency with which a risk event is expected to occur within a single calendar year.

Example: An event occurring once every 4 years has an ARO = 1 / 4 = 0.25 .

Example: An event occurring 12 times a year has an ARO = 12.0 .

Example: An event occurring once every 10 years has an ARO = 0.1 .

Annualized Loss Expectancy (ALE): The statistically expected financial loss the enterprise will suffer from this risk event on an annualized basis ($ Amount per year).

  • 2. Worked Calculation Scenarios
  • Calculation Scenario 1: E-Commerce Database Ransomware Exposure

Asset Value (AV): Customer transaction database valued at $4,000,000 .

Exposure Factor (EF): A successful ransomware attack is estimated to corrupt or lock 40% of operational data ( EF = 0.40 ).

Annualized Rate of Occurrence (ARO): Threat intelligence estimates this specific exploit occurs once every 2 years ( ARO = 0.50 ). Step 1: Calculate Single Loss Expectancy (SLE)

  • SLE = AV x EF
  • SLE = $4,000,000 x 0.40 = $1,600,000
  • Step 2: Calculate Annualized Loss Expectancy (ALE)
  • ALE = SLE x ARO
  • ALE = $1,600,000 x 0.50 = $800,000 per year
  • Calculation Scenario 2: Justifying Safeguard Investment via CBA

The Chief Information Security Officer (CISO) proposes deploying an automated immutable backup and endpoint detection system costing $150,000 annually .

With the safeguard in place, the Exposure Factor is reduced to 10% ( EF = 0.10 ) and the ARO drops to once every 5 years ( ARO = 0.20 ). Step 1: Calculate Mitigated SLE

SLE_mitigated = $4,000,000 x 0.10 = $400,000

  • Step 2: Calculate Mitigated ALE
  • ALE_mitigated = $400,000 x 0.20 = $80,000 per year
  • Step 3: Calculate Gross Annual Loss Reduction (Savings)
  • Gross Savings = ALE_current - ALE_mitigated
  • Gross Savings = $800,000 - $80,000 = $720,000 per year
  • Step 4: Calculate Net Annual Benefit (Cost-Benefit Analysis)
  • Net Annual Benefit = Gross Savings - Annual Safeguard Cost
  • Net Annual Benefit = $720,000 - $150,000 = $570,000 per year

Governance Conclusion: Because the Net Annual Benefit is positive (+$570,000), the security control is financially justified and provides a massive Return on Security Investment (ROSI).

3. The Factor Analysis of Information Risk (FAIR) Framework

While classical quantitative models calculate single-point static numbers, modern risk engineering relies on the Factor Analysis of Information Risk (FAIR) framework (standardized by The Open Group as Open FAIR™). FAIR establishes a precise, non-redundant ontology that breaks risk down into its fundamental causal components. +-----------------------------------------------------------------------------+

  • | FAIR RISK ONTOLOGY STRUCTURE |
  • | |
  • | [ RISK ] |
  • | (Probable Frequency & Magnitude of Loss) |
  • | | |
  • | +-------------------+-------------------+ |
  • | | | |
  • | v v |
  • | [ LOSS EVENT FREQUENCY (LEF) ] [ LOSS MAGNITUDE (LM) ] |
  • | (How often loss occurs/year) (Financial loss/event) |
  • | | | |
  • | +----------+----------+ +----------+----------+ |
  • | | | | | |
  • | v v v v |
  • | [THREAT EVENT [VULNERABILITY] [PRIMARY LOSS] [SECONDARY |
  • | FREQUENCY (TEF)] (VULN) (Direct Org) LOSS] |
  • | | | | (External) |
  • | +----+----+ +----+----+ +----+----+ +----+----+ |
  • | | | | | | | | | | | |
  • | v v v v v v v v v v |
  • | [CF] [PoA] [TCap] [CS] [Prod][Resp][Repl] [Fine][Rep][Leg]|
  • +-----------------------------------------------------------------------------+

FAIR Taxonomy Breakdown:

A. Loss Event Frequency (LEF)

LEF is the estimated number of times within a given time period (typically one year) that a threat actor will successfully compromise an asset and cause loss.

Threat Event Frequency (TEF): The frequency with which a threat actor comes into contact with an asset and acts against it.

Contact Frequency (CF): How often an adversary reaches the perimeter (e.g., random network scans or targeted phishing).

Probability of Action (PoA): The probability that the threat actor will actually launch an exploit once contact is established.

Vulnerability (VULN): In FAIR, vulnerability is defined strictly as the probability that a threat event will result in a loss event .

Threat Capability (TCap): The force, skill, and resources an attacker can bring against a control (expressed as a percentile).

Control Strength (CS): The defensive strength of the control baseline compared to a benchmark threat capability (expressed as a percentile).

FAIR Principle: If TCap > CS , a loss event occurs; if CS >= TCap , the control repels the attack.

B. Loss Magnitude (LM)

Loss Magnitude is the total financial and operational impact resulting from a realized loss event. +-----------------------------------------------------------------------------+

  • | FAIR LOSS MAGNITUDE CLASSIFICATION |
  • | |
  • | PRIMARY LOSS (Direct Impact to Victim): |
  • | - Productivity: Revenue lost during system downtime and operational halt. |
  • | - Response: Incident response retainers, forensic analysts, legal counsel.|
  • | - Replacement: Hardware rebuild, clean restore, software re-licensing. |
  • | |
  • | SECONDARY LOSS (Reactions of External Stakeholders): |
  • | - Fines & Penalties: Statutory sanctions (GDPR, HIPAA, PCI-DSS, SEC). |
  • | - Legal & Judgments: Customer class-action lawsuits, shareholder suits. |
  • | - Reputation / Churn: Lost future contracts, brand damage, stock drop. |
  • | - Competitive Advantage: Stolen trade secrets, blueprints, pricing data. |
  • +-----------------------------------------------------------------------------+

Important

Primary vs. Secondary Loss on the CRISC Exam: Primary losses are incurred directly by the organization as an immediate consequence of the attack (e.g., internal staff overtime, paying for clean-up). Secondary losses occur only when external third parties (regulators, customers, media, investors) react to the primary loss event. An organization might have a low primary loss ($20,000 incident response) but suffer catastrophic secondary loss ($10,000,000 in GDPR fines and churn).