Which of the following is NOT a parameter used in FAIR ranges/distributions?

The correct choice is the average, as it is not typically used as a parameter in the context of FAIR ranges or distributions. In FAIR (Factor Analysis of Information Risk), risk is often expressed in terms of ranges defined by specific parameters that give deeper insights into the potential variation and uncertainty associated with risks.

The maximum and minimum parameters are essential because they define the boundaries of the risk range, providing insight into the worst-case and best-case scenarios. Standard deviation is also a critical parameter, as it measures the dispersion or variability around the mean, helping to quantify the uncertainty in the risk estimates.

The average, while it is a common statistic in many contexts, does not directly play a role in defining the risk ranges or distributions in FAIR. Instead, FAIR focuses on ranges (maximum, minimum) and measures that reflect the variability (like standard deviation) to capture the inherent uncertainties in risk assessment.