What is the CIA triad?
The CIA triad is the basic model security teams use to describe what they protect. It names three properties of data and systems: confidentiality, integrity and availability. Every control, from a firewall rule to a background check, protects at least one of them, and every incident can be described by which of them was lost. The name has nothing to do with the U.S. intelligence agency; it is simply the initials of the three properties.
The three properties and the controls behind them
| Property | Question it answers | Typical controls |
|---|---|---|
| Confidentiality | Can only authorized people read it? | Encryption, access control, least privilege, MFA, data classification |
| Integrity | Is the data accurate and unchanged? | Hashing, digital signatures, write permissions, change management, file integrity monitoring |
| Availability | Can authorized users reach it when they need it? | Redundancy, tested backups, patching, DDoS protection, UPS and generators |
Integrity covers accidental changes as well as malicious ones. A failing disk that corrupts a file is an integrity problem even though no attacker was involved. In the same way, a power cut or an expired TLS certificate that takes a site offline is an availability failure, not only an operations problem.
Availability is often stated as a percentage of uptime. Three nines (99.9 percent) allows about 8.8 hours of downtime a year, and five nines (99.999 percent) allows a little over 5 minutes.
The DAD triad is the attacker's view
Some texts describe attacks with the DAD triad, the mirror image of CIA:
- Disclosure breaks confidentiality: a database dumped to a leak site, an email sent to the wrong person, a storage bucket left open to the internet.
- Alteration breaks integrity: changed bank details on an invoice, an edited firewall rule, a tampered software update.
- Destruction, or denial, breaks availability: ransomware encrypting servers, a DDoS flood, wiped backups.
The first question after an incident is which of the three happened, because that tells you how serious it is and which controls failed.
Example: mapping one incident to the triad
A ransomware group copies 40 GB of customer records from a file server, then encrypts the server and demands payment. Two properties are hit. The copied records are a confidentiality loss, and the encrypted server is an availability loss. Restoring from backups fixes availability but does nothing for confidentiality, because stolen data can't be taken back. The right control depends on which property is at stake: backups and redundancy for availability, encryption at rest and access control for confidentiality.
The properties pull against each other
Strengthening one property can weaken another. Encrypting data protects confidentiality, but losing the key makes the data permanently unavailable. Strict account lockout protects confidentiality against password guessing, yet an attacker can trigger lockouts to deny service to real users. Copying data to many sites improves availability and creates more places for it to leak. Organizations choose the balance per system: a public website cares most about integrity and availability, while a payroll database puts confidentiality and integrity first.
CIA triad vs. AAA and non-repudiation
Authentication, authorization, accounting and non-repudiation sit beside the triad in the same objective and show up in the same answer lists. They are mechanisms and assurances that support the triad, not members of it. Authentication proves identity, authorization decides access, accounting records activity, and non-repudiation stops someone from denying an action. Integrity is the closest neighbor: a hash proves data is unchanged, which is integrity, while a digital signature also ties the data to its signer, which is non-repudiation.
CIA triad on the CompTIA Security+ exam
The triad belongs to SY0-801 objective 1.1, which covers the foundational security concepts. Questions rarely ask what the letters stand for. They describe harm and expect you to name the property or the control that protects it. Words such as exposed, leaked, intercepted or viewed point to confidentiality. Altered, tampered, corrupted or untrusted point to integrity. Down, unreachable, slow or locked point to availability. A stolen unencrypted laptop is a confidentiality problem, so backups are the wrong answer there. A server knocked offline by a traffic flood is an availability problem, so encryption is the wrong answer. When an option names non-repudiation, authentication or authorization, treat it as a related concept, not a part of the triad.