Home › Resources › The CIA Triad

Executive Summary

The CIA triad describes the three fundamental goals of information security: keeping data confidential, preserving its integrity, and ensuring its availability. Nearly every security control exists to protect one or more of these three properties. It is the mental model professionals use to reason about what they are actually trying to defend.

What It Is

The CIA triad is a model that breaks information security into three objectives. Confidentiality means that only authorized people and systems can see the data. Integrity means the data is accurate, complete, and has not been altered without authorization, whether by an attacker or by accident. Availability means the data and the systems that serve it are accessible to authorized users when they are needed. Every meaningful security decision can be traced back to one or more of these goals, which is why the triad appears in almost every security framework and certification.

Why It Matters

The triad gives teams a shared language for trade-offs. Locking a system down tightly can protect confidentiality but hurt availability if legitimate users cannot get in. Rushing to restore availability after an outage can undermine integrity if it means recovering from unverified data. Understanding which property a control protects, and which it might weaken, lets professionals make deliberate choices instead of accidental ones. For anyone in a security, risk, audit, or governance role, being able to map a threat or a control to the triad is a baseline expectation.

How It Works

In practice, teams choose controls that reinforce each property. Confidentiality is supported by access control, encryption, and data classification. Integrity is supported by hashing, digital signatures, version control, and change management. Availability is supported by redundancy, backups, capacity planning, and resilient architecture. A single control often serves more than one goal at once, and a single incident often threatens more than one. Ransomware, for example, attacks availability by locking files, and increasingly attacks confidentiality by stealing them first. The triad is a checklist for reasoning, not a set of products.

Architecture Diagram

Visual Workflow

Common Attacks

• Data theft and eavesdropping that break confidentiality
• Tampering with records, files, or transactions that breaks integrity
• Denial of service and ransomware that break availability
• Man in the middle attacks that can break confidentiality and integrity at once
• Insider misuse that quietly undermines any of the three goals

Common Mistakes

• Focusing only on confidentiality and forgetting integrity and availability
• Adding controls without noticing they harm availability for legitimate users
• Treating backups as an availability control while never checking their integrity
• Assuming encryption alone protects data that is also at risk of tampering
• Failing to classify data, so every asset is protected the same generic way

Best Practices

• Classify data so protection matches its sensitivity and importance
• Use encryption in transit and at rest to protect confidentiality
• Use hashing, signatures, and change control to protect integrity
• Build redundancy and tested backups to protect availability
• Document which goal each major control serves
• Review trade-offs whenever a control noticeably slows or blocks users

Quick Checklist

• Data classification scheme defined and applied to key assets
• Encryption in transit and at rest for sensitive data
• Integrity checks (hashes or signatures) on critical files or records
• Redundancy or failover for systems that must stay available
• Backups tested with a verified, clean restore
• Access reviews confirming only authorized users can reach the data

Recommended Tools

Industry Standards

Career Relevance

The CIA triad is foundational for SOC analysts, security engineers, GRC analysts, auditors, and architects. Interviewers use it to test whether a candidate can reason about security rather than just name tools. Privacy and AI governance professionals, the audience AI-Governance-Jobs.com serves, also rely on it to explain why a given control or requirement exists.

Interview Questions

• What are the three parts of the CIA triad, and give a control for each?
• Give an example of a control that protects confidentiality but can hurt availability.
• Which part of the triad does ransomware attack, and how has that changed?
• How would you protect the integrity of a critical financial record?
• Why might availability be the top priority for some systems over confidentiality?

Related Certifications

Further Reading

• NIST Glossary: confidentiality, integrity, availability
• NIST Cybersecurity Framework 2.0
• CISA: Cybersecurity Best Practices

FAQ