Those of you who regularly follow our weblog know that we feel very strongly about risk and risk management. We believe that misconceptions about risk and security have led to a number of problems for our profession.

When Jack Jones and I sat down over a year ago and decided to start a business, we realized a couple of very important things:

1. We felt we had something important to offer the Information Security/Risk Management community.
2. The basis for what we had to offer stemmed from the understanding of Information Risk that FAIR provides.

FAIR was developed by Jack on his own time while he was CISO of Nationwide Insurance. The success FAIR had there, as well as its subsequent successes in other companies, have not only been very encouraging but, for us, very satisfying.

As such, we’ve come to the following conclusion:

The best opportunity to have a positive impact on our profession will come from making the FAIR framework an open standard to the Information Risk Management Community.

As a result, today we’re announcing that RMI is no longer pursuing a patent for FAIR, and is releasing the FAIR framework under a creative commons license http://creativecommons.org/licenses/by-nc/2.5/. In addition, RMI is working with The Open Group to establish a FAIR Risk Management Forum with the purpose of making the framework and definitions in FAIR an open, international standard for adoption.

We’ve put up a webpage with some FAQs and answers here.

Naturally, we’re very excited. We hope you will continue to monitor this space and The Open Group for new developments and community action.

Posted on January 5