Confidentiality is the information security principle that ensures information is not made available or disclosed to unauthorised individuals, entities, or processes. It is about protecting the secrecy of data. For information to be confidential, appropriate controls must be in place to prevent unauthorised access or disclosure.
Examples
- Encryption: Encrypting data, both when it’s stored and when it’s being transmitted, ensures that even if an unauthorised party gains access, they can’t read the information.
- Access Control: Limiting who can view certain documents or data sets through the use of permissions and passwords.
- Non-disclosure Agreements (NDAs): A legal contract that protects confidential information by requiring a party to keep it secret.
ISO 27001 Context
Confidentiality is one of the three core pillars of information security, alongside Integrity and Availability. These three principles are collectively known as the CIA Triad and form the fundamental basis of a strong Information Security Management System (ISMS).
Stuart Barker
Stuart Barker is qualified ISO 27001 Lead Auditor and a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
Now he is founder and Lead ISO 27001 Consultant at High Table, the worlds number 1 dedicated ISO 27001 Consultancy.
