What it means
The CIA triad provides three useful questions about an asset: who should be able to see it, who may change it, and when must authorized users be able to use it? These correspond to confidentiality, integrity, and availability. The triad helps beginners describe a security outcome before discussing a product or control.
One event can affect several properties at once. Ransomware may interrupt access, alter records, and accompany data theft. The triad is also a starting point rather than a complete model of every concern. Safety, privacy, accountability, and business context may require additional analysis even when the three properties have been considered.
AN ILLUSTRATIVE SCENARIO
A clinic medication record
A clinic reviews how it protects a medication record. Confidentiality concerns who may read it. Integrity concerns whether its contents match the authorized clinical record and whether changes are traceable. Availability concerns whether clinicians can obtain it when needed. Restricting access so tightly that authorized care staff cannot retrieve it may damage availability. The team works with clinical owners to define normal access, controlled emergency access, and review of exceptional use, rather than maximizing one property in isolation.
Put it to work
- Choose a specific asset and write one concrete loss scenario for each property, avoiding broad labels such as “data security.”
- Ask the owner which consequences matter most in the actual workflow and identify tradeoffs, dependencies, and exceptional operating conditions.
- Select and test protections for each relevant property, then check whether improving one has introduced an unacceptable problem for another.
How to check your work
A reviewer should be able to connect each chosen safeguard to a named property and a meaningful consequence. Test cases should include both protection against misuse and successful legitimate use.
Connect the ideas
- Confidentiality
The property that information is available only to people or systems authorized to see it.
- Integrity
The property that data and processes remain complete and unaltered except by authorized action.
- Availability
The property that authorized people can use a system or record when they need it.
- Asset
Anything whose disclosure, alteration, destruction, or downtime would harm a person or organization.