A risk manager is calculating the probable financial impact of a ransomware attack using the FAIR model. Which factor is MOST critical to estimate the annual loss exposure?
Trap 1: Recovery time objective (RTO)
RTO is a business continuity metric, not a direct FAIR factor.
Trap 2: Cost of cyber insurance premium
Insurance premium is a financial transfer, not a risk quantification factor.
Trap 3: Number of affected systems
Number of systems influences loss magnitude, but frequency is also needed.
- A
Recovery time objective (RTO)
Why wrong: RTO is a business continuity metric, not a direct FAIR factor.
- B
Threat event frequency
Threat event frequency is a key component in FAIR for calculating annual loss exposure.
- C
Cost of cyber insurance premium
Why wrong: Insurance premium is a financial transfer, not a risk quantification factor.
- D
Number of affected systems
Why wrong: Number of systems influences loss magnitude, but frequency is also needed.