Security is the set of controls used to protect information, systems, and assets from unauthorized access, misuse, disruption, or loss. It is primarily concerned with confidentiality, integrity, and availability. In an organisation, security is judged by how effectively it reduces risk and supports operational resilience within defined legal and business constraints.
What Security Means as a Cybersecurity Control Set
Security is not a single product or policy, but a control set that combines prevention, detection, response, and recovery. Its purpose is to reduce the likelihood and impact of unauthorized access, misuse, disruption, and loss while preserving the organisation’s ability to operate within legal, contractual, and business constraints.
Because the term is broad, its practical meaning depends on what is being protected, what threats matter most, and how much residual risk the organisation is willing to accept. In mature environments, security is treated as an operating discipline rather than a one-time configuration or a compliance checkbox.
The Core Objectives of Security
The classic confidentiality, integrity, and availability model still captures the central aims of security, but it is best understood as a starting point rather than a complete programme. Confidentiality limits who can see information, integrity preserves correctness and trustworthiness, and availability keeps systems and services usable when they are needed.
Modern security also has to account for resilience, recoverability, and trust boundaries across users, systems, suppliers, cloud services, and software supply chains. That is why security teams increasingly look at identity, logging, segmentation, configuration, and recovery together instead of in isolation.
How Security Is Put Into Practice
Security becomes real through layered controls: access control, authentication, authorisation, monitoring, secure configuration, patching, data protection, backup, and incident response. NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference point because it organises these safeguards into a control catalogue that maps cleanly to operational security work.
For organisations that want a higher-level operating model, NIST Cybersecurity Framework 2.0 helps structure security around govern, identify, protect, detect, respond, and recover. That framing is especially useful when security must be translated into measurable ownership, not just technical implementation.
Security also extends into how access is designed and constrained. NIST SP 800-207 Zero Trust Architecture is relevant here because it treats trust as something to verify continuously rather than assume once at the network edge.
Security, Trust, and Organisational Resilience
Security is ultimately judged by whether it preserves trust in the organisation’s information and operations under real-world pressure. That means the term covers not only attacks, but also misconfiguration, insider misuse, supply-chain weakness, and failures that degrade service or expose data.
The most effective security programmes connect technical safeguards to operational resilience: if a control fails, the organisation should still be able to detect the issue, contain the damage, restore critical services, and prove what happened. In practice, that is what separates mature security from a simple catalogue of tools.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Security depends on controlling who can access systems and information. |
| AU-2 — Audit Events | Security requires logging that supports detection, investigation, and accountability. | |
| Recommendation — Define account ownership and lifecycle rules to reduce unauthorized access. Log material security events so misuse and compromise can be investigated. | ||
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Security is shaped by business, legal, and operational context. |
| PR.AA-05 — Identity Management, Authentication and Access Control | Security relies on controlling access to protect information and systems. | |
| RC.RP-01 — Recovery Plan Execution | Security includes recovery after disruption, loss, or compromise. | |
| Recommendation — Align security priorities to the organisation’s mission, obligations, and risk appetite. Enforce least-privilege access controls for users and services. Test and execute recovery plans so critical services can be restored quickly. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org