The CIA Triad: The Foundation of Information Security
If you work in tech, data, or anything that involves handling information, youhave almost certainly encountered the CIA triad, whether you knew what it wascalled or not. It is one of the most foundational frameworks in informationsecurity, and understanding it is not optional if you are serious aboutprotecting your organisation’s data.
CIA stands for Confidentiality, Integrity, and Availability. Three principles.Each one distinct. Together they form the basis of how we think about securinginformation.
Confidentiality
Confidentiality is about ensuring that information is only accessible to thosewho are authorised to see it. This is not just about keeping secrets. It isabout access control, data classification, and understanding who should be ableto see what, and why.
In practice this means asking: who has access to this data? Should they? Issensitive information segregated from general access? Are permissions regularlyreviewed, or do people accumulate access over time because nobody ever revokedit?
Breaches of confidentiality do not always look like a dramatic hack. Sometimesthey look like an employee emailing a spreadsheet to the wrong person.Sometimes they look like a shared drive that grew without governance and nownobody is entirely sure who can see what.
Integrity
Integrity is about ensuring that data is accurate, complete, and has not beenaltered in an unauthorised way. The data you are working with should be what itsays it is.
This matters more than people realise. If your data has been tampered with,corrupted, or degraded in transit and you do not know, every decision you makebased on that data is compromised. Integrity failures are particularlydangerous precisely because they are not always obvious. You can continueoperating on bad data for a long time before anyone notices.
Controls for integrity include things like checksums, audit logs, versioncontrol, and change management processes. The goal is to be able to answer: isthis data exactly what it should be, and can I prove it?
Availability
Availability is about ensuring that information and systems are accessible toauthorised users when they need them. Having data is not the same as being ableto use it.
This principle covers everything from disaster recovery and business continuityplanning to basic questions like: do the right people know where the data is?Can they access it when they need to? Is it in a usable format? Availabilityfailures are not always caused by attacks or outages. Sometimes they are causedby poor data management, siloed systems, or simply nobody having documentedwhere anything lives.
Why All Three Matter Together
The triad works as a system. Prioritising one at the expense of the otherscreates vulnerability.
