We have our assets and we know the threats. Now it's time to connect the dots and calculate the Risk. As an IT Manager, the temptation is to invent a custom spreadsheet, but in the corporate world (and to pass compliance audits), you must rely on recognized standards. Let's explore the two most authoritative frameworks.

1. The Qualitative Approach: NIST SP 800-30

NIST's Special Publication 800-30 is the de facto standard of the US government. It offers a rigorous and tested approach. It relies predominantly on qualitative or semi-quantitative assessments: probability and impact are classified on scales such as Very High, High, Medium, Low.

The Pro: It is relatively simple to implement and provides a solid, unassailable baseline for compliance (e.g., ISO 27001).
The Con: It is subjective. One sysadmin's "High Risk" might be another's "Medium Risk", and most importantly, it doesn't tell the CFO how much money the company is risking.

2. The Quantitative Approach: FAIR

FAIR (Factor Analysis of Information Risk) flips the paradigm. Instead of using colors and adjectives, it uses statistics and financial modeling (like Monte Carlo simulations). It breaks risk down into its fundamental mathematical factors: Event Frequency and Financial Loss Magnitude (very reminiscent of the ARO and ALE concepts we discussed previously).

The Pro: It speaks the Board's language. Instead of saying "There is a critical risk of ransomware", FAIR allows you to say: "There is a 15% probability of experiencing ransomware this year, with an expected loss between €50,000 and €250,000".
The Con: It requires historical data, precise measurements, and a very high level of corporate maturity to be implemented correctly.

3. Which to choose?

The strategic advice is a hybrid approach: use NIST SP 800-30 for the initial screening and to quickly discard minor risks, and apply FAIR's quantitative analysis only to risks considered "High" or "Critical" to justify security investments (ROI) to management.

Index: IT Risk Assessment Playbook

• Ep. 1: Asset Visibility and Shadow IT
• Ep. 2: Threat Modeling: Knowing the Adversary
• Ep. 3: Framework Comparison: NIST vs FAIR [You are here]
• Ep. 4: The Risk Register: From Theory to Governance