The CIA triad names the three goals of information security: confidentiality, integrity and availability. Confidentiality keeps information from the wrong people, integrity keeps it accurate and unaltered, and availability keeps it usable when needed. Every incident can be described by which of the three it damaged, and controls can be chosen the same way.
What are the formal definitions?
NIST FIPS 199 quotes the US federal law, 44 U.S.C. section 3542. Confidentiality means preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information, and a loss of confidentiality is the unauthorized disclosure of information. Integrity means guarding against improper information modification or destruction, including ensuring non-repudiation and authenticity, and a loss of integrity is the unauthorized modification or destruction of information. Availability means ensuring timely and reliable access to and use of information.
Notice the word timely. A system that works but takes a day to answer has failed availability for many purposes.
What does each one look like when it fails?
Confidentiality fails when a database of customer records is copied by someone who should not have it, or when a laptop with unencrypted files is lost. Integrity fails when someone changes a price list, a payment destination or a log entry, and nobody notices. Availability fails when a service is down, a database is encrypted by ransomware or a certificate expires.
Constructed example: an attacker breaks into a payroll system. If they copy the salary file, that is a confidentiality loss. If they change a bank account number in a record, that is an integrity loss, and often the more dangerous one because it can go unnoticed until someone is not paid. If they lock the system on payday, that is availability. One break-in, three possible impacts.
How do you rate the impact?
FIPS 199 uses the triad to categorize systems. For each of the three objectives it asks for a potential impact of low, moderate or high. Low means a limited adverse effect on operations, assets or individuals. Moderate means a serious adverse effect. High means a severe or catastrophic one. The standard gives the notation as a set of three pairs, such as confidentiality high, integrity moderate and availability moderate, for one information type.
This is the useful move for a real organization. Do not give a system one overall rating. Rate the three separately, because they are often different. A public marketing site may have low confidentiality needs and high availability and integrity needs. An internal research archive may be the reverse.
Do the three goals conflict?
Sometimes. Strong access controls protect confidentiality and can slow people down, which costs availability. Heavy redundancy raises availability and multiplies the copies that need protecting. Logging protects integrity and creates a new store of sensitive data. Security design is choosing a balance per system, with the ratings above as the guide.
What is missing from the triad?
The triad is a starting point, and some teams want to name accountability, privacy or safety separately. FIPS 199's own definition of integrity already includes non-repudiation and authenticity, and the definition of confidentiality includes personal privacy. For systems that affect physical safety, add safety as an explicit objective rather than hoping the triad covers it.
How to check or apply this
- List your main systems and data types.
- For each, rate confidentiality, integrity and availability separately as low, moderate or high, and write one sentence of justification.
- Choose controls to match the highest ratings: encryption and access control for confidentiality, validation, hashing and audit trails for integrity, redundancy, backups and capacity for availability.
- Tag each incident with the objectives it affected, so patterns show up.
- Revisit ratings after a major change or incident.
- Use the ratings to set recovery targets, patching priority and monitoring depth.
Quick check
What does the C stand for in the CIA triad?
Confidentiality, meaning authorized restrictions on access and disclosure. It is unrelated to the Central Intelligence Agency.
Is ransomware an attack on confidentiality or availability?
Mainly availability, because it makes systems unusable. Data theft that often accompanies it is also a confidentiality loss.
Sources
- NIST FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
- NIST FIPS 199 publication page
Last reviewed: 18 October 2026.
