Measuring and Managing Information Risk
A FAIR Approach
- 2nd Edition - November 1, 2025
- Authors: Jack Freund, Jack Jones
- Language: English
- Paperback ISBN:9 7 8 - 0 - 4 4 3 - 1 3 4 8 4 - 5
- eBook ISBN:9 7 8 - 0 - 4 4 3 - 1 3 4 8 5 - 2
Measuring and Managing Information Risk: A FAIR Approach, Second Edition provides a proven and credible framework for understanding, measuring, and analyzing information risk of a… Read more
Purchase options
Institutional subscription on ScienceDirect
Request a sales quoteMeasuring and Managing Information Risk: A FAIR Approach, Second Edition provides a proven and credible framework for understanding, measuring, and analyzing information risk of any size or complexity using the Factor Analysis of Information Risk (FAIR) methodology developed over ten years and adopted by corporations worldwide. This new edition covers such key areas as risk theory, risk calculation, scenario modeling, and communicating risk within the organization, and also includes new chapters and essays from industry professionals. It provides a step-by-step guide to help managers make better business decisions by understanding their organizational risk.
The field has advanced significantly in the past 10 years and this all-new edition reiterates the importance of the foundations of risk measurement but adds information about modern methods to integrate quantitative risk assessment methods into your security programs. This includes the integration of security telemetry data, outside data sources, approaches to automating FAIR assessments, and how to align methods and programs to security standards and regulations. Further discussed is how such approaches are being used by third-party agencies to provide CRQ data to the investors, underwriters, and regulators. This book is a valuable resource for all those who need the foundations, methods, and techniques for measuring, assessing, and communicating cyber risk to enable an organization to build an organizational IT risk management program. It serves as both a practical how-to guide for those new to the industry as well as tenured professionals that need a formalized guide for implementation.
- Uses factor analysis of information risk (FAIR) as a methodology for measuring and managing risk in any organization, with insights on how to apply the FAIR methodology based on over 15 years of applied experience
- Carefully balances theory with practical applicability and relevant stories of successful implementation
- Includes examples from a wide variety of businesses and situations presented in an accessible writing style
- Includes new chapters on Standards and Regulatory Alignment, Building Quantitative Risk Programs, Assessment Automation, and Risk Measurement Red Flags, as well as significant revisions to cover the new FAIR-CAM standard and short essays from others in the industry
Security and risk executives, directors, managers, and analysts; IT risk managers; information security professionals, students of OpenGroup’s FAIR Certified Risk Analyst Certification Exam, graduate business or IT students taking courses in risk management and IT security Those new to the field of cybersecurity, including people in mathematical or quantitative professions (mathematics, economics, accounting, and business management), as well as those in adjacent professions such as life sciences
1. Introduction
2. Risk Concepts
3. FAIR Risk Ontology
4. FAIR Terminology
5. Measurement
6. Analysis Process
7. Interpreting Results
8. Risk Analysis Examples
9. Common Problems
10. Controls
11. Standards and Regulatory Alignment
12. Organizational Risk Decision Making
13. Metrics
14. Implementing Risk Management
15. Building Quantitative Risk Programs
16. Assessment Automation
17. Risk Measurement Red Flags
18. Invited Contribution
2. Risk Concepts
3. FAIR Risk Ontology
4. FAIR Terminology
5. Measurement
6. Analysis Process
7. Interpreting Results
8. Risk Analysis Examples
9. Common Problems
10. Controls
11. Standards and Regulatory Alignment
12. Organizational Risk Decision Making
13. Metrics
14. Implementing Risk Management
15. Building Quantitative Risk Programs
16. Assessment Automation
17. Risk Measurement Red Flags
18. Invited Contribution
- No. of pages: 460
- Language: English
- Edition: 2
- Published: November 1, 2025
- Imprint: Butterworth-Heinemann
- Paperback ISBN: 9780443134845
- eBook ISBN: 9780443134852
JF
Jack Freund
Dr. Jack Freund is a leading voice in cyber risk measurement and management. As VP, Head of Cyber Risk Methodology for BitSight, Jack has overall responsibility for the systemic development and application of frameworks, algorithms, and quantitative and qualitative methods to measure cyber risk. Previously, Jack was Director of Risk Science at quantitative risk management startup RiskLens and Director of Cyber Risk for TIAA. Jack holds a Ph.D. in Information Systems from Nova Southeastern University, a Masters in Telecommunication and Project Management, and a BS in CIS. Jack has been named a Senior Member of the IEEE and ACM, a Fellow of the IAPP and FAIR Institute, and a Distinguished Fellow of the ISSA. He is the 2020 recipient of the (ISC)2 Global Achievement Award, 2018 recipient of ISACA’s John W. Lainhart IV Common Body of Knowledge Award, and the FAIR Institute’s 2018 FAIR Champion Award.
Affiliations and expertise
VP, Head of Cyber Risk Methodology for BitSight, US.JJ
Jack Jones
Jack Jones has worked in information security for over 35 years, serving as a CISO with three different companies, including a Fortune 100 company. His work was recognized in 2006 with the ISSA Excellence in the Field of Security Practices award, and in 2012 he received the CSO Compass award. As an Adjunct Professor at Carnegie Mellon University, he teaches in the CRO and CISO executive programs. Jones also created the Factor Analysis of Information Risk (FAIR) model, as well as the FAIR Controls Analytics Model (FAIR-CAM), since adopted as international standards. Jones is the Chief Risk Scientist at RiskLens and Chairman of the FAIR Institute, an award-winning global non-profit organization.
Affiliations and expertise
Co-founder and president of CXOWARE, Inc. , US.