Beyond the core risk-factor tree, how does the FAIR ecosystem model controls and loss costs — what do FAIR-CAM and FAIR-MAM add?

FAIR-CAM models how controls act on the risk factors (prevent, detect, respond); FAIR-MAM standardises the cost categories a loss is built from. Together they turn the bare factor tree into something you can actually parameterise.

* Where the two companion models plug in: FAIR-CAM's control functions push down frequency and magnitude; FAIR-MAM's cost modules build the loss figure. *

The core FAIR tree tells you Risk = Loss Event Frequency × Loss Magnitude — but not where your controls plug in or which costs to add up. Two companion models from the FAIR Institute fill those gaps:

• FAIR-CAM (Controls Analytics Model) — classifies controls by what they do to a loss event:
  • Loss Event Prevention — reduces how often events become losses (pushes down frequency).
  • Loss Event Detection and Loss Event Response — shorten and shrink an event that's already happening (push down magnitude).
  • Supporting layers — Variance Management controls (keep the other controls actually working, e.g. patching discipline, config management) and Decision Support controls (give the right information for risk decisions).
• FAIR-MAM (Materiality Assessment Model) — a menu of standardised cost modules for estimating loss magnitude: information privacy costs, business interruption, cyber extortion, network security costs, financial fraud, media liability, hardware bricking, post-breach security improvements, reputational damage, and so on.

Why the split matters: when someone proposes a control, FAIR-CAM tells you which factor it moves (frequency vs. magnitude) — so you can simulate the risk with and without it; FAIR-MAM keeps two analysts' "Loss Magnitude" estimates comparable, because both built them from the same cost checklist instead of gut feel.

Tip: Map it to the factor tree: FAIR-CAM hangs under Loss Event Frequency (and partly magnitude via response); FAIR-MAM is the recipe book for Primary and Secondary Loss.

Go deeper:

• FAIR Controls Analytics Model (FAIR Institute) — the official FAIR-CAM overview: how control functions map to loss-event frequency and magnitude.
• FAIR Materiality Assessment Model (FAIR Institute) — the official FAIR-MAM page: the ten cost modules behind defensible loss estimates.

Go deeper:

• What is FAIR (FAIR Institute) — the standards body's overview of FAIR as the quantitative model for cyber risk.
• Factor analysis of information risk (Wikipedia) — the factor tree in text: LEF (TEF × vulnerability) and loss magnitude.