The CIA triad is the model that defines information security as protecting three properties of information: confidentiality (only authorised people and systems can read it), integrity (it is not changed or destroyed improperly) and availability (it can be reached and used when needed). Almost every security control, standard and risk assessment can be traced back to one or more of these three goals. This guide explains the triad in plain language first, then goes into practitioner depth: the official definitions, the FIPS 199 impact levels, concrete controls for each property, how the triad maps to NIST CSF 2.0, SP 800-53 and ISO/IEC 27001:2022, and where non-human identities and secrets fit. It is written for people new to security and for practitioners who need to use the triad properly in risk assessments and architecture reviews.
Key takeaways
- Three goals, one decision tool. Confidentiality, integrity and availability describe what can go wrong with information: it leaks, it is altered, or it cannot be used.
- The properties compete. More encryption and stricter access can reduce availability; more replicas improve availability but widen the confidentiality surface. Good design states which property matters most for each system.
- Impact levels make it measurable. FIPS 199 rates each property LOW, MODERATE or HIGH, and a system takes the highest rating of the information it holds (the high water mark).
- Extensions fill real gaps. Authenticity, non-repudiation and accountability matter for transactions, signatures and audit, and the Parkerian hexad adds possession and utility.
- Secrets break all three at once. A stolen API key or signing key can expose data, forge changes and let an attacker run ransomware, so credentials deserve the highest rating of the systems they unlock.
What it is
In plain terms, the triad asks three questions about any piece of information or any system: who can see it, can we trust it, and can we use it when we need to. If the answer to any of them is wrong, there is a security incident, whether or not an attacker was involved. A misconfigured storage bucket is a confidentiality failure, a bad database migration that corrupts records is an integrity failure, and a failed data centre power supply is an availability failure.
The official definitions come from US federal law (44 U.S.C. 3552, formerly 3542) and are repeated in FIPS 199 and the NIST glossary:
| Property | Official definition (paraphrased from 44 U.S.C. 3552 via NIST) | Plain-language test | Typical failure |
|---|---|---|---|
| Confidentiality | Preserving authorised restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information | Can only the right people and systems read it? | Data exfiltration, public cloud bucket, over-shared link, eavesdropping on unencrypted traffic |
| Integrity | Guarding against improper information modification or destruction, including ensuring non-repudiation and authenticity | Is it accurate, complete and from who it claims to be from? | Tampered payment file, forged token, malicious code in a build, silent data corruption |
| Availability | Ensuring timely and reliable access to and use of information | Can authorised users use it when they need it? | Ransomware, denial of service, deleted backups, single point of failure |
The model is decades old and no single author owns it, but it is now embedded in law and standards: ISO describes an ISO/IEC 27001 information security management system as one that preserves the confidentiality, integrity and availability of information, and NIST SP 800-53 control PL-8 requires security architectures to describe how the system protects all three.
How it works
The triad is used in two ways: to rate how much each property matters for a system, and to choose controls that protect the properties that matter most.
Rating: FIPS 199 impact levels
FIPS 199 (February 2004) rates the potential impact of losing each property:
- LOW: a limited adverse effect on organisational operations, organisational assets or individuals.
- MODERATE: a serious adverse effect.
- HIGH: a severe or catastrophic adverse effect.
The result is written as a security category, for example SC public information = {(confidentiality, NA), (integrity, MODERATE), (availability, MODERATE)}, the standard's own example for public content on a web server. Confidentiality is not applicable to information that is already public, but its integrity still matters: a defaced or altered public page causes harm. For a whole system, each property takes the highest rating of any information type on it (the high water mark), and NA is not allowed at system level because every system is at least LOW. Outside US government, the same idea appears as a business impact analysis or an asset criticality rating (NIST CSF 2.0 ID.AM-05).
Choosing controls for each property
| Property | Preventive controls | Detective controls | Recovery controls | NIST SP 800-53 Rev. 5 |
|---|---|---|---|---|
| Confidentiality | Least privilege, MFA, encryption at rest (AES-256 disk and database encryption) and in transit (TLS 1.2 or 1.3), data classification, DLP rules | Access logging, alerts on bulk reads or unusual egress | Key rotation, credential revocation, breach notification process | AC-6, SC-8, SC-13, SC-28 |
| Integrity | Change control, code signing, digital signatures, input validation, write-once storage, separation of duties | File integrity monitoring, hash comparison (SHA-256), database checksums, reconciliation reports, tamper-evident audit logs | Restore from a known-good backup, verify backup integrity before restoring | SI-7, AU-9, AU-10, SC-13 |
| Availability | Redundancy (N+1, multiple availability zones), capacity planning, DDoS protection, patching, rate limiting | Uptime and latency monitoring, capacity alerts, ransomware behaviour detection | Offline or immutable backups, tested restore runbooks, alternate sites, defined RTO and RPO | SC-5, CP-6, CP-9, CP-10 |
Attackers map to the triad too. In MITRE ATT&CK v20, T1048 Exfiltration Over Alternative Protocol attacks confidentiality, T1565 Data Manipulation attacks integrity, and T1486 Data Encrypted for Impact, T1485 Data Destruction and T1499 Endpoint Denial of Service attack availability. See the Encryption Guide, the Hashing Guide and the DDoS Protection Guide.
Applying it: a step-by-step approach
- Inventory information types for the system (customer records, payment data, logs, source code, credentials) and record where each is stored and processed.
- Rate C, I and A separately for each type using LOW, MODERATE and HIGH with written criteria (for example, HIGH availability means more than four hours of downtime stops a regulated service). Involve the business owner, not only IT.
- Take the high water mark for the system and record the rationale, so later reviewers can challenge it.
- Select controls per property from your baseline (SP 800-53 baselines, ISO 27001 Annex A, CIS Controls), adding more where a property is rated HIGH.
- Test the weakest property first: run a restore test for availability, a tamper test (change a monitored file and confirm the alert) for integrity, and an access review for confidentiality. Pilot new blocking controls in monitor mode before enforcing.
- Plan rollback for any control that can hurt another property, such as a DLP rule that blocks business email or an encryption change that locks out a recovery team, and keep break-glass keys under dual control.
- Re-rate on change: new data types, new integrations and new AI agents with data access can raise a rating.
Where NHIs and secrets fit
Credentials used by machines (API keys, service account passwords, OAuth tokens, certificates and signing keys) are information assets in their own right, and their compromise usually hits all three properties. In the Microsoft Storm-0558 key breach, a stolen consumer signing key let the attacker forge tokens that Exchange Online accepted: an integrity and authenticity failure in the identity system that became a confidentiality failure for the mailboxes it unlocked. Rate a secret at least as high as the highest-rated system it can reach, store it in a vault rather than code or configuration, and log its use. See the Secrets Management Guide and the Non-Human Identity (NHI) Guide.
Why it matters
The triad gives security, IT and business owners a shared vocabulary. Instead of asking "is this secure?", a review asks "which property matters most here, and what would losing it cost?". That changes decisions:
- Different systems, different priorities: a public website is integrity and availability first; an HR system is confidentiality first; a hospital or OT control system is often availability and integrity first, because a safe, working process matters more than secrecy.
- Trade-offs become explicit: client-side encryption with customer-held keys maximises confidentiality but means lost keys equal lost data. Choose it where confidentiality is HIGH and the owner accepts the availability risk; choose provider-managed keys with strict access where recovery matters more.
- Small and large organisations: a small firm can rate a handful of systems in a spreadsheet and lean on SaaS provider controls for availability; a large organisation needs ratings in the CMDB so control baselines, backup tiers and monitoring are applied automatically.
- Incidents are easier to scope: the Change Healthcare breach was both a confidentiality failure (data on 192.7 million people, per UnitedHealth's August 2025 figure) and an availability failure, as pharmacies and providers could not submit claims for weeks after systems were disconnected. Response, notification and recovery plans all need to cover both.
Framework mapping
| Property | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A (examples) | CIS Controls v8.1 |
|---|---|---|---|
| All three | PR.DS-01 (data at rest), PR.DS-02 (data in transit), PR.DS-10 (data in use), ID.AM-05 (asset prioritisation) | A.5.12 Classification of information | Control 3 Data Protection |
| Confidentiality | PR.AA-05 (least privilege) | A.8.24 Use of cryptography, A.5.15 Access control | Control 6 Access Control Management |
| Integrity | RC.RP-03 (backup integrity verified before restoration) | A.8.32 Change management, A.8.15 Logging | Control 8 Audit Log Management |
| Availability | PR.DS-11 (backups), PR.IR-04 (capacity) | A.8.13 Information backup, A.8.14 Redundancy of information processing facilities | Control 11 Data Recovery |
See the NIST CSF 2.0 Guide and the ISO 27001 Certification Guide.
Measuring it
- Coverage: percentage of production systems with a recorded C/I/A rating and named owner.
- Confidentiality: percentage of HIGH-confidentiality data stores with encryption at rest and quarterly access reviews completed.
- Integrity: integrity monitoring alerts on critical files triaged within the agreed time, and unapproved changes found per month.
- Availability: successful restore tests against target RTO and RPO for HIGH-availability systems.
- Secrets: share of machine credentials in a vault with rotation, versus found in code or configuration.
Common misconceptions
- "Security means confidentiality." Many programmes spend most of their effort on keeping data secret and treat backups and change control as IT operations. Ransomware is mainly an availability attack, and the Colonial Pipeline attack shows the cost: the intrusion was in IT systems, yet the company shut the pipeline down as a precaution.
- "Encryption solves integrity." Encryption alone does not prove data was not altered. Use authenticated encryption (such as AES-GCM), message authentication codes or digital signatures where tampering matters.
- "Backups guarantee availability." Backups reachable with the same admin credentials as production are often encrypted or deleted in the same attack, and backups never restored are untested assumptions. See the Backup Security and Immutable Backup Guide.
- "One rating per system is enough." Rating a system "HIGH" without separating C, I and A hides the trade-offs. A public price list may be NA for confidentiality but HIGH for integrity.
- "The triad covers everything." It says little about who did something, whether a message really came from its sender, or privacy rights such as purpose limitation. That is why the extensions below exist.
- "It only applies to data." Configuration, identities, logs and models are information too. Altered audit logs (an integrity failure) can hide every other failure.
Related concepts
| Concept | What it adds | Typical controls |
|---|---|---|
| Authenticity | Data originated from its purported source (NIST glossary) | Digital signatures, mutual TLS, signed tokens with issuer and audience checks |
| Non-repudiation | Protection against someone falsely denying an action (SP 800-53 Rev. 5); control AU-10 | Digital signatures with keys under the signer's sole control, timestamped signed logs |
| Accountability | Actions can be traced uniquely to the entity that performed them | Unique accounts for every human and machine, no shared credentials, protected audit logs |
| Parkerian hexad | Donn Parker's six-element model: confidentiality, possession or control, integrity, authenticity, availability and utility | Possession covers stolen but still encrypted media; utility covers data you hold but cannot use, such as backups encrypted with a lost key |
| Privacy | Rights of individuals over personal data, beyond keeping it secret | Data minimisation, purpose limitation, retention rules |
The triad also sits underneath the wider foundations of security: see the Core Security Principles Guide for least privilege and separation of duties, the Security Control Types Guide for preventive, detective and corrective controls, the Threat vs Vulnerability vs Risk Guide for how impact ratings feed risk, and the Defence in Depth Guide for layering controls around each property.
Practitioner checklist
- Record separate C, I and A ratings (LOW, MODERATE, HIGH) for every production system, with the information types and the owner who agreed them.
- Write rating criteria in business terms (financial loss, safety, regulatory notification, hours of downtime) so ratings are consistent.
- Apply the high water mark and re-rate whenever new data types, integrations or AI agents are added.
- For HIGH confidentiality: encryption at rest and in transit, least privilege, MFA and alerts on bulk access.
- For HIGH integrity: change control, signing or hashing of critical artefacts, file integrity monitoring and protected audit logs.
- For HIGH availability: redundancy, offline or immutable backups on separate credentials, and restore tests against RTO and RPO.
- Rate secrets and signing keys at the level of the highest system they unlock, store them in a vault and rotate them.
- Document trade-offs where one property is weakened to protect another, with the owner's sign-off and a rollback plan.
Standards and references
- NIST: FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
- NIST CSRC Glossary: Confidentiality
- NIST CSRC Glossary: Integrity
- NIST CSRC Glossary: Availability
- NIST CSRC Glossary: Non-repudiation
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- ISO: ISO/IEC 27001:2022 Information security management systems
Related NHI Mgmt Group resources: Core Security Principles Guide · Defence in Depth Guide · Data Classification Guide · Secrets Management Guide