Controls Analysis Model (FAIR-CAM)

What FAIR-CAM Measures

Controls Analysis Model, or FAIR-CAM, is used to estimate how much a specific security control reduces a defined threat scenario. It translates control effect into measurable factors so risk analysis can compare control value in financial terms rather than by intuition alone.

At its core, FAIR-CAM helps practitioners ask a different question from simple control checklists: not “is the control present?” but “how much does this control change the loss profile of this scenario?” That shift matters when organisations must compare multiple candidate controls, justify spend, or decide whether a partial control is worth retaining.

How FAIR-CAM Breaks Down Control Effect

FAIR-CAM evaluates control performance through factors such as coverage, strength, and reliability. Coverage asks whether the control addresses the relevant attack or failure path at all, strength reflects how hard it is for the threat to defeat the control, and reliability captures whether the control works consistently enough to matter in practice.

This decomposition is useful because a control can look strong on paper but still provide weak real-world risk reduction if it only covers part of the scenario or fails inconsistently. The model therefore supports more disciplined reasoning about where control value actually comes from, and where residual exposure remains.

How It Fits Into Cyber Risk Analysis

FAIR-CAM is not a standalone security control framework. It is a decision-support method that plugs into broader cyber risk quantification, where control effect feeds into estimates of threat frequency, vulnerability, and loss magnitude.

That makes it especially helpful when leaders need to compare controls that protect the same scenario, or when they need to explain why one control materially changes risk while another does not. The method is most useful when the scenario is specific enough to model and the organisation can make defensible estimates about how the control behaves under real conditions.

For readers who want the wider quantitative context, the FAIR-CAM Controls Analytics Model Guide explains how control valuation, dependencies, and operational efficacy fit into scenario-based analysis, while the Cyber Risk Quantification Guide places FAIR-CAM inside the broader CRQ workflow.

What Good FAIR-CAM Use Looks Like

FAIR-CAM works best when estimates are explicit, reviewable, and tied to the control’s actual operating conditions rather than to aspirational policy language. A weak model usually treats controls as binary, assumes perfect enforcement, or ignores whether the control is applied consistently across the scenario boundary.

It is also most valuable when paired with a clear investment question. The model should help decide whether a control meaningfully reduces loss exposure, whether a different control would do better, or whether the organisation is paying for symbolic rather than measurable protection. In practice, that is why the most useful outputs are scenario-specific and decision-oriented, not generic maturity statements.

Practitioners who are comparing control options or trying to justify spend can also use the Identity and NHI Security Business Case Guide to connect quantified control effects to funding decisions, and the Quantitative vs Qualitative Cyber Risk Guide to understand why measurable control valuation is more decision-useful than ordinal scoring alone.

Related resources from NHI Mgmt Group

• Fair Controls Assessment Model (FAIR-CAM)
• Shared Responsibility Model
• Open Factor Analysis Of Information Risk (FAIR) Model
• When does a legacy ERP controls model become a governance risk?