The CIA Triad: Confidentiality, Integrity and Availability Explained

The CIA triad means confidentiality, integrity and availability, the three properties that security controls exist to protect. Every incident, from a leaked customer list to a ransomware outage, damages at least one of them. That is why risk assessments, security standards and data protection law all use the CIA triad as their common language.

What does CIA stand for in cyber security?

CIA stands for confidentiality, integrity and availability. Each property fails in a different way and needs different controls:

The properties pull against each other. Locking data down improves confidentiality but can hurt availability, which is why the right balance comes from a cyber security risk assessment, not a fixed rule.

What are examples of confidentiality, integrity and availability breaches?

The quickest way to understand each property is to see one fail. For each, here is a worked example of a breach and the control that would have stopped it.

Confidentiality in cyber security

Confidentiality means information is seen only by the people, systems and processes allowed to see it.

• Worked example: a sales manager leaving for a competitor exports the full customer list to a personal cloud drive. Nothing is changed or deleted, but the data is now held by someone with no right to it.
• Control that would have stopped it: least-privilege access to bulk exports, data loss prevention rules on uploads to personal storage, and removing leavers’ access promptly.

Integrity in cyber security

Integrity means information stays accurate and complete, and is changed only by authorised people in authorised ways. An integrity breach is any unauthorised or accidental change to information. Common examples:

• Payment diversion: a fraudster changes the bank details on a genuine supplier invoice, the pattern behind business email compromise.
• Checkout skimming: a malicious script added to a payment page, for example through cross-site scripting, alters what the customer’s browser runs, so card data is copied as it is typed. The integrity breach leads straight to a confidentiality breach.
• Configuration tampering: an attacker edits a firewall rule or turns off logging to hide their activity.

Control that would have stopped the payment diversion: a call-back check on a phone number already on file before any bank detail change, plus two-person approval for new payees. For the checkout, the PCI DSS script controls in 6.4.3 and 11.6.1 detect unauthorised changes.

Availability in cyber security

Availability means information and systems can be used when authorised people need them.

• Worked example: ransomware encrypts an online retailer’s file server late on a Friday, together with the backup drive permanently connected to it. Orders cannot be processed until the systems are rebuilt.
• Control that would have stopped it: backups kept offline or immutable, restores tested on a schedule, and a rehearsed incident response plan. Our ransomware prevention guide covers the rest.

Many incidents hit more than one property. Ransomware is mainly an availability breach, but if data is stolen first it is a confidentiality breach too.

How do card payments and cloud services apply the CIA triad?

How do ISO 27001, PCI DSS and UK GDPR use the CIA triad?

ISO 27001. ISO/IEC 27000 defines information security as the preservation of confidentiality, integrity and availability, and clause 6.1.2 of ISO/IEC 27001:2022 requires risks to be identified in exactly those terms. ISO 27002:2022 also tags each of its 93 controls, the same set listed in Annex A of ISO 27001, with the properties it protects. Our guide to what ISO 27001 is covers the standard in full.

PCI DSS. PCI DSS v4.0.1 is centred on confidentiality: protecting stored account data (Requirement 3) and encrypting it in transit (Requirement 4). Integrity controls run through it too, including change detection on critical files (11.5.2) and the payment page script controls in 6.4.3 and 11.6.1, which became mandatory on 31 March 2025. See what PCI DSS is for the full standard.

UK GDPR. Article 5(1)(f) makes “integrity and confidentiality” a data protection principle, and Article 32 requires measures that ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, plus the ability to restore access to personal data after an incident. The legal definition of a personal data breach in Article 4(12) covers all three: unauthorised disclosure or access, alteration, and loss or destruction. A ransomware outage can therefore be a personal data breach even if nothing leaves the building, and must be reported to the ICO without undue delay, and where feasible within 72 hours, unless it is unlikely to put people at risk. Our comparison of PCI DSS and GDPR shows where the two overlap.

Is the CIA triad enough?

It covers most needs, but some properties do not fit neatly inside it:

• Authenticity: proof that information or a person is genuine.
• Non-repudiation: proof that someone performed an action, so they cannot later deny it, usually through digital signatures and logs.
• Accountability: actions can be traced to a specific person or system.

ISO/IEC 27000 notes that these properties can also be involved in information security. Donn Parker’s “Parkerian hexad” goes further, adding possession, authenticity and utility to the original three.

Two related models also come up. AAA (authentication, authorisation and accounting) describes how access is granted and traced, and is one of the main ways of protecting confidentiality and integrity. The DAD triad (disclosure, alteration and destruction) is the mirror image of CIA, describing what an attacker is trying to achieve.

How does Sovereign Secure use the CIA triad?

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, Qualified PIN Assessor and Card Production Security Assessor, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. The triad sits behind all of that work: a PCI DSS assessment is largely about the confidentiality of card data, while a penetration test finding matters because of what it would let an attacker read, change or disrupt. For more definitions, browse the cyber security glossary.

Next step: to work out which risks to confidentiality, integrity and availability matter most to your organisation, follow our cyber security risk assessment guide or talk to our team.