Factor Analysis of Information Risk (FAIR™) provides a model for understanding, analyzing, and quantifying cyber risk and operational risk in financial terms. Among the various components of the model designed to support risk quantification, FAIR includes a framework for establishing data collection criteria.