FAIR Third-Party Risk Model (FAIR-TAM)

What the FAIR Third-Party Risk Model measures

FAIR-TAM treats third-party exposure as a measurable loss problem, not just a qualitative concern. It estimates how much financial loss could arise when a supplier, vendor, or other external party creates a pathway for data access, service disruption, control failure, or contractual dependency.

The model is useful because it forces teams to separate the business relationship from the loss event. A vendor may be critical to operations, but the risk question is narrower: what is the probable frequency and magnitude of loss if that dependency is compromised, unavailable, or misused?

How FAIR-TAM structures third-party cyber loss

FAIR-TAM applies FAIR logic to third-party scenarios by decomposing the event into loss drivers that can be reasoned about and compared. That usually means identifying the asset or process exposed, the threat or failure condition, the likely forms of impact, and the controls that would reduce frequency or magnitude.

This makes the model more precise than broad vendor scoring. Instead of collapsing every supplier issue into a single risk rating, teams can distinguish between access-related loss, outage-related loss, and dependency-related loss, each of which may deserve a different treatment strategy.

The model is especially helpful where external parties have access to systems, data, credentials, APIs, or operational processes. In those cases, the third party is not just a procurement concern, it is part of the exposure pathway.

Where FAIR-TAM is most useful

FAIR-TAM is strongest when organisations need to prioritise among many third-party risks with limited budgets. It helps compare a low-probability but high-impact supplier dependency against a more frequent but smaller control weakness, using a common financial lens.

It is also useful for board and executive reporting because it translates technical uncertainty into business terms. That does not eliminate judgement, but it makes assumptions explicit and easier to challenge.

For a practical risk-management baseline, organisations often pair FAIR-TAM with broader cyber risk governance and treatment processes, including the Risk Management Guide and the Quantitative vs Qualitative Cyber Risk Guide.

Practitioner use in third-party programmes

Governance implication: FAIR-TAM works best when it is tied to a defined third-party inventory, a clear owner for each critical relationship, and a repeatable method for updating assumptions as contracts, access paths, and service dependencies change. Without that discipline, the numbers can look precise while the underlying exposure shifts unnoticed.

Why practitioners should care: The model gives security, procurement, and risk teams a shared way to discuss vendor exposure without reducing everything to subjective colour codes. It is particularly useful when a supplier breach, outage, or misuse of access would have measurable financial consequences.

Teams that build this into investment decisions often combine it with business-case thinking, such as the Identity and NHI Security Business Case Guide and the IAM Business Case and ROI Guide, when access governance is part of the third-party exposure.

Related resources from NHI Mgmt Group

• Why does fine-tuning a third-party scoring model create compliance risk?
• Why does model genealogy matter when organisations assess the risk of third-party AI models?
• Who should be accountable for third-party cyber risk under a shared-responsibility model?
• Why do deployers still carry AI Act risk when a third-party model provider marks the output?