TheFundamental Inferential Risk Method (FIRM)is a quantitative approach to evaluating technology risk and the impact of information security programs.