Confidentiality

What is Confidentiality?

Confidentiality is the information security principle that ensures information is not made available or disclosed to unauthorised individuals, entities, or processes. It is about protecting the secrecy of data. For information to be confidential, appropriate controls must be in place to prevent unauthorised access or disclosure.

Examples

• Encryption: Encrypting data, both when it’s stored and when it’s being transmitted, ensures that even if an unauthorised party gains access, they can’t read the information.
• Access Control: Limiting who can view certain documents or data sets through the use of permissions and passwords.
• Non-disclosure Agreements (NDAs): A legal contract that protects confidential information by requiring a party to keep it secret.

ISO 27001 Context

Confidentiality is one of the three core pillars of information security, alongside Integrity and Availability. These three principles are collectively known as the CIA Triad and form the fundamental basis of a strong Information Security Management System (ISMS).

About the author

🎓 MSc Security 🛡️ Lead Auditor ⚡ 30+ Years Exp 🏢 Ex-GE Leader

Stuart Barker

ISO 27001 Ninja

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigor with extensive operational experience, including a decade leading Data Governance for General Electric (GE).

As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.