OGOF-101 Open FAIR 2 Foundation: Syllabus and How to Pass

Updated on 12 October 2026. What’s new: the OGOF-101 exam fee is corrected to $405 USD; the 40-question format and 60% pass mark are as the vendor's data sheet states

A security manager calls a data-exposure risk "high", and the finance director asks how many dollars that is. Open FAIR is the method for answering, and the OGOF-101 exam (40 questions, 60 minutes, 60% to pass) is its entry-level certificate. Here is an invented example, not real data: if a loss is expected about once every two years and costs between $50,000 and $250,000 each time, the rough annual exposure is $25,000 to $125,000.

That sentence is what the exam teaches you to write. Below you will find which Open FAIR exam this is, where the 40 questions come from, how the loss model works, what to revise and how long to give it.

Which Open FAIR exam is OGOF-101, and where does OG0-041 fit?

OGOF-101 is the exam for The Open Group Open FAIR 2 Foundation certification. The Open Group's own data sheet lists two Open FAIR exams side by side: OG0-041 (called Open FAIR Part 1, leading to Open FAIR Foundation) and OGOF-101. The difference is the body of knowledge underneath. OG0-041 rests on the Risk Analysis (O-RA) Standard version 1.0 and the Risk Taxonomy (O-RT) Standard version 2.0. OGOF-101 rests on O-RA version 2.0.1 and O-RT version 3.0.1.

The Open Group's Open FAIR certification FAQ calls the newer credential "a new and separate certification", so a holder of the older one who wants the 2 version has to sit the new exam. The vendor says the older certificate has not lost its value, that moving across is optional, and that it will keep supporting the older version as long as the market needs it. If an employer or a course quotes a code to you, check whether it is OG0-041 or OGOF-101 before you buy any study material, because the question counts and standards differ.

The same FAQ lists what changed between versions, which matters if you are reading older books or blog posts. The "confidence level in the most likely value" estimate parameter was dropped and replaced by the choice of distribution. The five NIST Cybersecurity Framework functions were brought into the standard. In the taxonomy, "Accomplish Assigned Mission" was removed as a threat action, the external loss factor "Detection" became "External Party Detection", and the organizational loss factor "Due Diligence" became "Reasonable Care". Material that still uses the old names is describing the older paper.

The facts at a glance

Item	OGOF-101
Exam name	The Open Group Open FAIR 2 Foundation
Certification earned	The Open Group Certified Open FAIR 2 Foundation
Exam fee	USD $405
Duration	60 minutes
Number of questions	40 multiple-choice questions
Passing score	60% (24 of 40)
Delivery	Pearson VUE, at a test center or by online proctoring
Prerequisites	None; supervised and closed book

The pass mark, question count and time limit match the Open Group's Open FAIR exam data sheet, which I checked in October 2026 against its certification FAQ. At 60 minutes for 40 questions you have about 90 seconds a question, and you can miss 16 and still pass.

Which syllabus areas carry the marks, and which can you not afford to skim?

The Open Group publishes an exam plan that says how many of the 40 questions come from each area. Two areas dominate: the Risk Taxonomy and the Risk Analysis Methodology and Process.

Syllabus area	Questions	Share of the paper
Open FAIR Body of Knowledge Overview	1	2.5%
Basic Risk Concepts	5	12.5%
Risk Taxonomy	14	35%
Risk Measurement	4	10%
Risk Analysis Methodology and Process	11	27.5%
Risk Analysis Quality Considerations	5	12.5%
Total	40	100%

Add the two big areas and you get 25 questions, which is one more than the 24 you need to pass. That does not mean you can ignore the rest, because thin knowledge elsewhere leaves no margin for a bad day on the taxonomy. It does tell you where an hour of revision earns the most: every taxonomy term you can place on the factor tree is worth more than a polished answer on the one-question overview.

The OGOF-101 syllabus page lists every learning outcome. It also lists Terminology, which has no separate line in the vendor's question plan. That suggests the definitions are tested inside the questions from the other areas rather than as a block of their own, though that is my reading of the plan, not something the vendor states. Either way, you must be able to define terms such as Threat Event Frequency, Contact Frequency, Probability of Action, Threat Capability, Resistance Strength and Loss Magnitude without hesitation.

Foundation certifications sit at the first two levels of Bloom's taxonomy, remembering and understanding, according to the vendor's FAQ. The syllabus verbs fit that: describe, define, identify, explain, differentiate. You are not asked to run a simulation in the exam. You are asked to know what each part of the method is for and how the parts connect.

How does a "high risk" label turn into a dollar range?

Open FAIR defines risk as the probable frequency and probable magnitude of future loss, and the taxonomy breaks that into two branches. Loss Event Frequency (LEF) is how often a loss is expected. Loss Magnitude (LM) is how much it costs when it happens. Everything else in the Risk Taxonomy section is a way of estimating one of those two.

LEF splits into Threat Event Frequency (TEF), how often a threat agent acts against an asset, and Vulnerability, the probability that a threat event becomes a loss event. TEF itself splits into Contact Frequency (how often the agent meets the asset, by random, regular or intentional contact) and Probability of Action (whether the agent goes ahead). The syllabus names three things that push Probability of Action up or down: the perceived value to the threat agent, the perceived effort, and the perceived risk of being caught.

Vulnerability splits again, into Threat Capability (the agent's time, resources and technical skill) and Resistance Strength (how well the controls hold up against that capability). A frequent trap is that Vulnerability here is a probability, not a weakness. The syllabus also expects you to know that you can estimate it from TEF and LEF, or from Threat Capability and Resistance Strength.

One invented scenario, worked through

The figures below are made up to show the shape of the reasoning. They are not drawn from any real organization or survey. Imagine an unprotected file share holding customer records, and a threat community of outside attackers.

Factor	Illustrative estimate	What it answers
Threat Event Frequency	4 attempts a year	How often does someone act against the share?
Vulnerability	1 in 8 (12.5%)	How often does an attempt succeed?
Loss Event Frequency	0.5 a year	TEF times Vulnerability: about once every two years
Loss Magnitude per event	$50,000 to $250,000, most likely $100,000	What does one event cost across all forms of loss?
Annual loss exposure	About $25,000 to $125,000, most likely $50,000	LEF times Loss Magnitude

Compare that with "high". The table gives the finance director a range, an assumption behind each line, and a place to challenge it. If she thinks successful attempts are rarer, she changes one row and the exposure moves. That is the practical difference between a labelled risk and an analysed one, and it is the idea the OGOF-101 exam is built around.

In a real analysis the estimates would be ranges with a most likely value and a chosen distribution, not single numbers. The exam expects you to know why: the syllabus says risk models are estimates built from the information available, so the honest output is a range.

What are the six forms of loss, and how do primary and secondary loss differ?

Loss Magnitude is where candidates drop marks they thought were safe, because the syllabus asks you to name six forms of loss and give an example of each. Learn them as a set.

• Productivity loss: reduced output, including revenue that is lost for good versus revenue that is only delayed. The syllabus draws that distinction deliberately.
• Response loss: the cost of handling the event, such as staff time, forensic help and notifying people.
• Replacement cost: the cost of repairing or replacing an asset that was damaged or lost.
• Fines and judgments: penalties, settlements and legal costs.
• Competitive advantage loss: the cost of losing an edge, for example when a design or plan reaches a rival.
• Reputation loss: the cost of customers, partners or investors trusting the organization less.

Next comes the split that organizes them. Primary loss falls on the primary stakeholder as a direct result of the event. Secondary loss exists only because secondary stakeholders, such as customers, regulators and the media, react to the primary event; the syllabus calls them "secondary threat agents" and gives secondary loss its own frequency (SLEF) and magnitude (SLM). In the invented file-share scenario, response cost and a few days of lost work are primary losses. A regulator's fine and customers leaving afterwards are secondary, and they only happen with some probability, which is why SLEF is a separate estimate.

The loss factors behind the magnitude

Loss factors explain why the same event costs one firm far more than another. The syllabus groups them into four categories:

• Asset loss factors: the value or liability of the asset (criticality, cost, sensitivity) and its volume.
• Threat loss factors: the action taken (access, misuse, disclose, modify or deny access), the threat agent's competence, and whether the agent is internal or external.
• Organizational loss factors: timing, reasonable care, response (containment, remediation, recovery) and detection.
• External loss factors: external party detection, legal and regulatory pressure, competitors, the media and secondary stakeholders.

The five threat actions line up with the classic security properties. Access, misuse and disclose tie to confidentiality, modify ties to integrity, and deny access ties to availability. Questions about matching an action to the breach it causes are easy marks if you have learned the pairing.

What does the paper expect on estimating, calibration and quality of analysis?

Risk Measurement carries only four questions, but the ideas feed the 11 on methodology and the 5 on quality, so treat it as a foundation, not a footnote. The syllabus asks you to explain the difference between accuracy and precision, and between subjectivity and objectivity. A precise estimate, such as "$41,372", can be badly inaccurate; a wide range that contains the truth is accurate and more honest.

Calibration is the set of habits that make an expert's range trustworthy. The syllabus lists five of them: starting from absurd estimates and narrowing, decomposing the problem into smaller factors, testing confidence with "the wheel", challenging your assumptions, and removing personal biases. It also expects you to explain what a Monte Carlo simulation does, which is to run many trials by drawing values from the ranges you supplied and produce a distribution of outcomes, not one number.

Methodology: the stages of an analysis

The methodology area has 11 questions, and it is the closest the paper comes to testing practice. Learn the five stages of an analysis and the parts of a Loss Scenario: primary stakeholder, asset, threat agent or community, threat event and loss event. You will be asked how to limit a scenario's scope when there are several threat communities, several observable losses or several asset types, how to estimate LEF directly or from TEF and Vulnerability, and how to present results as a single number or a distribution.

The same area covers modelling controls. The syllabus names four categories: avoidance, deterrent, vulnerability and responsive controls. In the Open FAIR taxonomy each category works on a different part of the factor tree, so a control is described by the factor it changes. Learn which factor goes with which category and you can answer most control questions by reasoning rather than recall. It also covers mapping Open FAIR to the NIST Cybersecurity Framework.

Quality considerations

The last area, five questions, is about trusting an analysis. Expect to explain why assumptions and rationale must be documented, why there are diminishing returns in gathering more data or estimating deeper in the taxonomy, and the difference between an organization's capacity for loss and its tolerance for loss. You also need the two risk qualifiers, fragile and unstable, the weaknesses of ordinal scales (no tangible economic meaning, ranges spanning several values, unusable in formulas), how to translate quantitative results into qualitative statements that management has approved, and three ways to troubleshoot a disputed analysis: revisit the scoping, change the abstraction level using the taxonomy, or run an additional analysis and compare.

What changes at work once you can speak Open FAIR?

The old version of this post listed five ways the exam helps in practice. They still hold, and they are best read as five habits the syllabus builds.

You quote a range, not a colour

The Risk Measurement and Methodology areas move you from "high, medium, low" to estimated ranges with stated assumptions. Ranges can be compared, added up and challenged, which colours cannot, and the syllabus explicitly lists the weaknesses of ordinal scales.

You use one vocabulary

Because the taxonomy fixes what a threat event, a loss event or a vulnerability means, two analysts describing the same scenario arrive at the same structure. That makes assessments from different teams comparable, and it makes arguments about the numbers, rather than about the words.

You can price a control

Take the invented file share again. Suppose encrypting it cuts the chance that an attempt succeeds from 1 in 8 to 1 in 40, so Loss Event Frequency falls from 0.5 to 0.1 a year. With the same $50,000 to $250,000 loss per event, the annual exposure drops from $25,000-$125,000 to $5,000-$25,000, a reduction of $20,000 to $100,000 a year. All figures are invented, but the method is the one the syllabus describes, and it is what turns "we need budget" into a business case.

You can talk to architects and auditors

Scoping an analysis means naming the asset, the stakeholders and the threat community, and the paper tests that. Enterprise architects hold the asset and process maps that the analysis needs as input, and mapping Open FAIR to the NIST Cybersecurity Framework gives security and audit teams a shared reference point. The exam does not test architecture, so see this as a way of making your analysis easy to plug into theirs.

You show your working

Documented assumptions, calibrated estimates and the troubleshooting techniques give you a way to answer "why that number?" without defensiveness. A senior reader will accept an estimate that comes with its reasoning far more readily than a confident number that comes with none.

What will the sitting cost, and how would you use four weeks before it?

The fee in the table above is USD $405. That is the direct booking price on the vendor's retail fee list for people certifications, in force since 1 February 2026 and read in October 2026; buying a voucher instead costs USD $435. The Open Group states that its accredited training courses include the exam, with a voucher code to book it at an exam provider's public test center, and that it recommends but does not require a course. Fees can change, so confirm the amount on the booking page before you pay.

You can book through Pearson VUE, at a test center or by online proctoring. The exam is supervised and closed book, with no prerequisites. English is the launch language, with extra time available for eligible candidates who are not first-language English speakers. The vendor says the certification does not expire, and that there are no current plans for an Open FAIR 2 Level 2 certification.

A four-week shape

• Week 1: the body of knowledge overview, the 30 or so defined terms, and Basic Risk Concepts, including the difference between risk management, assessment and analysis. Write each term on a card with its place in the taxonomy.
• Week 2: the Risk Taxonomy, the largest block. Redraw the factor tree from memory until you can do it without a prompt, then attach units of measure to each node.
• Week 3: Loss Magnitude, the six forms of loss, primary and secondary loss, and the four loss-factor categories, followed by Risk Measurement and calibration.
• Week 4: methodology and quality considerations, then two or three timed runs of 40 questions in 60 minutes.

For those week-four papers, the OGOF-101 practice exam on ProcessExam gives you full 40-question sets with the clock running. After each run, sort every miss by syllabus area and by cause: a term you did not know, a factor you mixed up, or a question you misread. Go back to the weakest area first, and keep revising the taxonomy to the end, since it is the largest block.

On the day, work through the paper once at about 90 seconds a question, flag anything that needs more thought and leave the last ten minutes for flagged items. Because the exam is multiple choice and the vendor sources I read state no negative marking, answer every question.

Frequently Asked Questions

How many questions are on the OGOF-101 exam and what is the pass mark?

OGOF-101 has 40 multiple-choice questions in 60 minutes, and you need 60%, which is 24 correct answers. That leaves room for 16 misses. The exam is supervised and closed book, and The Open Group publishes a plan showing how many questions come from each syllabus area.

Is OGOF-101 the same exam as OG0-041?

No. OG0-041 is the Open FAIR Part 1 exam for the older Open FAIR Foundation certification, with 80 questions in two hours. OGOF-101 is the Open FAIR 2 Foundation exam, with 40 questions in one hour, based on newer versions of the Risk Analysis and Risk Taxonomy standards.

Does the Open FAIR 2 Foundation certification expire?

According to The Open Group's Open FAIR certification FAQ, Open FAIR Foundation certifications do not expire. The FAQ also says there are currently no plans for an Open FAIR 2 Level 2 certification. Check the vendor's FAQ before you rely on this, since certification rules can change.

Are there prerequisites, and can you take OGOF-101 online?

There are no prerequisites for OGOF-101. The data sheet says it can be taken at an authorized test center or remotely with online proctoring. Either way it is supervised and closed book. Training is recommended by the vendor but not required to sit the exam.

Do you need to be good at maths to pass OGOF-101?

You need to be comfortable with ideas such as ranges, frequencies and distributions, but the syllabus verbs are describe, define, identify and explain. Foundation level sits at remembering and understanding, so the exam checks that you know how the factors fit together rather than asking for long calculations.

Select ratingPoorOkayGoodGreatAwesome

Rating: 4.8 / 5 (111 votes)