News and Analysis

Forrester reports a growing trend of Chief Information Security Officers (CISOs) using cyber risk quantification models to guide board-level decisions. These models, like the FAIR model, project the potential impact of cyber risks, translating complex technological issues into financial terms to better communicate with executives. Variants include the OCTAVE, COBIT, and TARA models, each with their own strengths. To select a suitable framework, organizations must consider their specific needs, industry, and risk appetite, among other factors.