What is the CIA Triad?
The CIA Triad is a fundamental model for information security, defining the three core principles that an organisation’s Information Security Management System (ISMS) aims to protect: Confidentiality, Integrity, and Availability.
- Confidentiality: Ensuring that information is accessible only to those who are authorised to have it. This prevents unauthorised disclosure of sensitive data.
- Example: Using encryption to protect customer data.
- Integrity: Maintaining the accuracy and completeness of information. It ensures that data has not been altered or corrupted in an unauthorised manner.
- Example: Using checksums to verify that a file has not been tampered with.
- Availability: Ensuring that information and associated systems are accessible and usable when needed by authorised users. This principle focuses on uptime and reliability.
- Example: Implementing a robust backup and recovery plan to restore services after a system failure.
ISO 27001 Context
The ISO 27001 standard and its controls are directly built around protecting the confidentiality, integrity, and availability of an organisation’s information assets. The CIA Triad provides the conceptual framework for managing information security risks and is implicitly referenced throughout the standard.
About the author
