---
title: "FAIR-CAM Controls"
slug: "fair-cam-controls"
updated: 2026-03-18T13:57:58Z
published: 2026-03-18T13:57:58Z
canonical: "docs.safe.security/fair-cam-controls"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# FAIR-CAM Controls

## Introduction

FAIR-CAM Controls are a core part of SAFE's approach to measuring and quantifying cyber risk. Instead of only showing vulnerabilities or tool outputs, SAFE evaluates how your security controls actually reduce risk.

These controls are based on:

- FAIR (Factor Analysis of Information Risk)
- FAIR-CAM

Using FAIR-CAM, SAFE connects:

**Security controls > Control effectiveness > Risk reduction > Business impact**

This allows organizations to understand not just what is wrong, but what to fix first.

## What are FAIR-CAM Controls?

FAIR-CAM defines controls as:

- Controls: Anything that can be used to directly or indirectly affect the frequency or magnitude of loss
- Control Function: How a control directly or indirectly affects the frequency or magnitude of loss
- Functional Domain: High-level categories that group controls based on how they influence risk

In simple terms

- A control = a security measure (tool, process, or policy)
- A function = what that control does (prevent, detect, respond, etc.)
- A domain = how that function impacts risk overall

## FAIR-CAM Controls Categorization

FAIR-CAM groups controls into three major categories based on their role in risk reduction:

### 1. Loss Event Controls (LEC)

These controls directly reduce the likelihood or impact of an attack.

They:

- Prevent attacks (e.g., email security)
- Reduce attack success (e.g., MFA)
- Detect threats (e.g., EDR, SIEM)
- Respond and recover (e.g., incident response, backups)

These are your primary defense controls

### 2. Variance Management Controls (VMC)

These controls ensure that your security controls:

- Work consistently
- Do not degrade over time

They improve the stability and consistency of other controls

## 3. Decision Support Controls (DSC)

These controls help improve:

- Risk-based decision making
- Governance and policy effectiveness

They ensure the organization is making informed and structured security decisions

## Control Maturity

SAFE evaluates how effective each control is using a concept called Control Maturity.

Control maturity determines:

- How much does a control actually reduce risk

It is based on three factors:

### 1. Capability

Measures how strong and effective a control is when working properly

Example: Advanced MFA vs basic password protection

### 2. Coverage

Measures how widely the control is applied across your organization

Example: MFA applied to all users vs only a subset

### 3. Reliability

Measures how consistently the control performs over time

Affected by:

- Vulnerabilities
- Misconfigurations
- Operational failures

How maturity is calculated

**Control Maturity = Capability × Coverage × Reliability**

This maturity directly impacts:

- Attack success probability (Susceptibility)
- Overall risk likelihood

## Calculating Reliability for a Control

Reliability reflects how dependable a control is in real-world conditions.

**How SAFE calculates Reliability**

Reliability is primarily influenced by:

- Security findings (vulnerabilities, misconfigurations, etc.)
- Data from integrated tools

These findings are:

- Scored based on severity, age, exploitability, and asset impact
- Aggregated into a population score
- Converted into a Reliability value

Higher findings → Lower reliability

Fewer or lower-risk findings → Higher reliability

> [!NOTE]
> Important Behavior in SAFE
> 
> Reliability is partially automated using integrations. However, it depends on:
> 
> - Capability
> - Coverage
> 
> If these are missing, Reliability cannot be meaningfully calculated.

## FAQs

**Q: Why isn’t Automated Reliability populating for my CAM Controls?**

Answer: Automated Reliability depends on Capability and Coverage maturity values.

Even if assets are populated, and findings are coming from integrations, SAFE still requires:

- Capability (how strong the control is)
- Coverage (where the control is applied)