To Whom It May Concern: 

Hello, my name is Luke Bader, Director of Membership and Programs at the FAIR Institute. I am 

submitting comments to the “Request for Information about Evaluating and Improving Cybersecurity 

Resources on The Cybersecurity Framework” on behalf of the entire Institute community, Jack Jones, 

Chairman and author of the FAIR model, our Board of Directors, and our Advisory Board. 

The FAIR Institute is an expert, non-profit organization led by cybersecurity and operational risk 

professionals to develop and promote better risk management practices through the financial 

quantification of risk. The Institute counts over 12,000 members representing 45% of the Fortune 1,000 

Companies and 25 U.S. Federal Government Agencies. The FAIR model was officially listed in 

the Informative Reference Catalog on the NIST CSF website in 2019. 

We believe that even as NIST CSF has seen wonderful adoption as a way to gauge an organization’s risk 

management posture or maturity, even more benefits can be realized. Specifically, there is a great 

opportunity to increase CSF’s value by enabling it to help organizations empirically measure and

prioritize their risk remediation efforts. 

With the recent release of the new FAIR Controls Analytics Model (FAIR-CAMTM), there is now a way to 

empirically measure control efficacy and risk reduction value. With some modifications, NIST CSF could 

map cleanly to FAIR-CAMTM, which would help organizations understand the efficacy and value of 

controls in their risk programs. 

Our proposed first steps are as follows: 

• Modify NIST CSF to provide more granularity at, or below, the subcategory level 

• Define measurement scales for each of the elements in the framework to reduce ambiguity and 

improve quality of benchmarking and measurement 

For a more complete look at the ideas underlying this proposal, below and attached are resources from 

a recent presentation given by Jack Jones, Overcoming the Challenges of Mapping NIST CSF to FAIR 

CAMTM. 

Upon your review, we welcome a call to discuss and answer questions. Please connect me with the 

person best suited to continue this effort. 

Thank you, 

Luke 
 

 

Overcoming the Challenges of 

Mapping NIST CSF to FAIRCAM 

Jack Jones 

Chairman FAIR Institute 
 

 

 

Perhaps a more accurate title... 

Overcoming the Challenges of 

Measuring the Efficacy and 

Value of NIST CSF 

Subcategories 

Jack Jones 

Chairman FAIR Institute 
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved The big question...

3

Can we take our NIST CSF scores, plug them 

into FAIR-CAM, and measure their efficacy 

and risk reduction value?
Copyright (c) 2022

FAIR Institute

All rights reserved For example...

4

How much less risk do we have if we improve 

our NIST CSF PR.IP-4 score from a “2” to a “3”? 

Two things we have to figure out:

1. How does PR.IP-4 affect risk?

2. What do the scores represent?
Quick FAIR-CAM refresher...

5
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved Clarifying terms

6

Control Functions: 

“How a control directly or 

indirectly affects the frequency 

or magnitude of loss.”

Controls: 

“Anything used to directly or 

indirectly affect the frequency 

or magnitude of loss.” 

Examples:

Policies

Passwords

Patching

Data backups

Auditing

etc...

Examples:

Loss Event Prevention

Loss Event Detection

Variance Prevention

Variance Correction

etc... 
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved Control Functional Domain Relationships

7

Risk

Threats

Assets

Controls Loss Event 

Controls

Directly affect the frequency 

or magnitude of loss.

Authentication

Access privileges

Data recovery processes

Etc...

Auditing

Vulnerability scans

Patching

Etc...

Variance 

Management Controls

Affect the reliability 

of other controls

Decision 

Support 

Controls

Enable appropriate 

expectation setting and 

prioritization

Policies

Asset management

Threat intelligence

Risk analysis

Etc.

Indirectly affect risk
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute Loss Event Control Functions All rights reserved

8

Loss Event Prevention Loss Event Detection Loss Event Response

Avoidance Deterrence Resistance

Directly Affecting the Frequency 

and Magnitude of Loss

Visibility Monitoring Recognition Event 

Termination Resilience Loss Reduction

% % % % Time % Time Time $

Units of measurement
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved Variance Management Control (VMC) Functions

9

% % Time Time Time Time
Challenge #1

How do the NIST CSF subcategories 

affect risk?

10
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved NIST CSF Functions

11

How do subcategories within NIST’s 

Protect function affect risk? Do they...

• reduce loss event frequency, or

• reduce loss magnitude?
Copyright (c) 2022

FAIR Institute

All rights reserved Let’s look at a few of them...

12

Reduces loss magnitude

Reduces the probability of 

poor decisions

Reduces the duration of 

control deficiencies
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved Initial mapping completed, and being reviewed

13

NIST CSF Elements FAIR-CAM Functions
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved Some map simply...

14

Decision Support Controls
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

Many do not... All rights reserved

15

Loss Event 

Controls

Variance 

Management 

Controls

• Very different ways of affecting risk

• Different units of measurement

A score of “2” for this subcategory represents what?

• The average for all of the functions it covers?

• Best case?

• Worst case?
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved The mapping breakdown (currently)...

16

FAIR-CAM Functional Domain Number of Mapped 

CSF Subcategories

Loss Event Control Functions 24

Variance Management Control Functions 9

Decision Support Control Functions 45

Multiple Functional Domains 29

These affect risk indirectly!
Copyright (c) 2022

FAIR Institute Overcoming the challenge... All rights reserved

The NIST CSF sub-categories have to be redefined to 

cover no more than a single control function.

17
Challenge #2

What do NIST CSF scores mean?

18
Copyright (c) 2022

FAIR Institute What we have to recognize is that... All rights reserved

• There is no standard scoring scale for NIST CSF

- There are no clear criteria for what constitutes a “2” versus a “3”

- Therefore, one organization’s “2” doesn’t necessarily equate to another 

organization’s “2”

• A single scale definition can not be defined to cover all of the control 

functions

- E.g., a scale for Loss Event Prevention controls can’t be the same as a scale for 

Variance Management Identification controls because they have different units of 

measurement

19
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved Translating ordinal values into quantitative ranges 

20

Ordinal 

Score

Range 

Minimum

Range 

Maximum

1 0% 25%

2 26% 50%

3 51% 75%

4 76% 100%

Essentially, translating by quartile

Ordinal 

Score

Range 

Minimum

Range 

Maximum

1 0% 50%

2 51% 75%

3 76% 90%

4 91% 100%

But that doesn’t represent reality

...and...

• some are binary 

• others have 

different units of 

measurement
© 2021 FAIR Institute

All rights reserved

Copyright (c) 2022

FAIR Institute

All rights reserved

21

Ordinal scale definitions have to be developed for 

each control function

Overcoming the challenge...
Wrapping Up...

22
Copyright (c) 2022

FAIR Institute

What we want to be able to do... All rights reserved

Measure the efficacy and risk reduction value of NIST CSF 

functions, so that we can prioritize effectively and choose 

cost-effective solutions

23
Copyright (c) 2022

FAIR Institute What has to happen first is... All rights reserved

• NIST CSF subcategories that cover multiple functions have to be 

made more granular and specific

- The FAIR Institute is reaching out to NISZT to offer assistance if 

desired

- Voices from the FAIR community will be important to help make 

this happen

• Standardized measurement scales have to be defined (these are 

aalready under development)

24
Questions?

25