The CIA Triad (Confidentiality, Integrity, Availability)

Overview

The CIA Triad is the foundational framework for information security. Every control, policy, and tool in cybersecurity exists to protect one or more of these three properties. If you understand the triad, you understand the purpose behind every security decision.

Confidentiality

Confidentiality means ensuring that information is accessible only to those authorized to see it. When a hacker steals credentials and reads your emails, confidentiality has been violated. Controls that protect confidentiality include encryption, access controls, and authentication requirements.

Integrity

Integrity means ensuring that data is accurate and has not been tampered with. When an attacker modifies a financial record or injects malicious code into a software update, integrity has been violated. Controls include file hashing, digital signatures, and audit logs.

Availability

Availability means ensuring that systems and data are accessible when authorized users need them. A DDoS attack that takes down a hospital’s network is an availability attack. Controls include redundancy, backups, failover systems, and DDoS mitigation.

Key Takeaways

When you assess a security incident, always ask: which part of the triad was violated? Was data exposed (confidentiality)? Was it altered (integrity)? Was it made inaccessible (availability)? That framing drives your response and helps you communicate the impact clearly to leadership and stakeholders.

Part of the free Intro to Cyber course by Cover6 Solutions.