November 5, 2026
Updated: November 5, 2026
What confidentiality, integrity and availability mean, how attackers break each one, which controls protect them, and how organizations use the triad in impact ratings, audits and vulnerability scoring.
Mohammed Khalil
The CIA triad is the model of three properties that information security protects: confidentiality, meaning only authorized people can see information; integrity, meaning information is not altered or destroyed improperly; and availability, meaning authorized users can reach information and systems when they need them. U.S. federal law and NIST define information security in exactly these terms, and ISO/IEC 27001, SOC 2 and the HIPAA Security Rule build on them. Organizations use the triad to rate how much a loss would hurt, choose controls and score penetration test findings, because CVSS rates every vulnerability by its CIA impact.
The CIA triad is a simple way to ask what could go wrong with a piece of information or a system. Could the wrong person see it? Could someone change it or destroy it? Could the people who need it lose access to it? Every security incident harms at least one of these three properties, and every security control exists to protect at least one of them.
The acronym has nothing to do with the U.S. intelligence agency. It is shorthand for the three security objectives written into U.S. federal law. The Federal Information Security Modernization Act defines information security as protecting information and systems from unauthorized access, use, disclosure, disruption, modification or destruction in order to provide integrity, confidentiality and availability (44 U.S.C. 3552). NIST's introductory guide, SP 800-12 Rev. 1, uses the same three terms, and FIPS 199 adds a plain definition of what a loss of each one means.
| Property | Federal definition (FISMA, quoted in FIPS 199) | What a loss means (FIPS 199) | ISO/IEC 27000 wording | HIPAA Security Rule wording |
|---|---|---|---|---|
| Confidentiality | Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information | Unauthorized disclosure of information | Information is not made available or disclosed to unauthorized individuals, entities or processes | Data is not made available or disclosed to unauthorized persons or processes |
| Integrity | Guarding against improper information modification or destruction, including ensuring non-repudiation and authenticity | Unauthorized modification or destruction of information | Property of accuracy and completeness | Data has not been altered or destroyed in an unauthorized manner |
| Availability | Ensuring timely and reliable access to and use of information | Disruption of access to or use of information or a system | Accessible and usable on demand by an authorized entity | Data is accessible and usable upon demand by an authorized person |
Sources for the table: FIPS 199 (February 2004), the ISO/IEC 27000 vocabulary used by ISO/IEC 27001, and the HIPAA definitions in 45 CFR 164.304.
The wording differs a little between sources, but the meaning is stable. Three details matter in practice.
First, the federal definition of integrity is broader than "the data is correct." It explicitly includes non-repudiation and authenticity, which is why some later models list those as separate properties. Second, NIST SP 800-12 Rev. 1 splits integrity into data integrity, meaning data has not been altered in an unauthorized way in storage, processing or transit, and system integrity, meaning a system performs its intended function without unauthorized manipulation. Third, all three definitions are about authorization. A database administrator reading customer records is not a confidentiality loss; an attacker reading the same records is.
NIST also warns against stopping at the three labels. SP 800-12 Rev. 1 says security objectives for a system may begin with an analysis of confidentiality, integrity and availability but should become specific and achievable for that system. "Protect confidentiality" is a starting point. "Only the billing team can export card-holder reports, and every export is logged" is an objective someone can test.
Confidentiality means information is seen only by people, processes and systems that are authorized to see it. It covers customer records, health data, credentials, encryption keys, source code, pricing, legal files and anything else whose disclosure would harm the organization or the people the data describes.
A real example shows how one flaw can expose many organizations at once. CISA and the FBI reported that from May 27, 2023, the CL0P ransomware gang exploited a previously unknown SQL injection flaw in Progress MOVEit Transfer, tracked as CVE-2023-34362. According to the joint advisory AA23-158A, the attackers installed a web shell on internet-facing servers and used it to steal data from the underlying databases. The main harm was disclosure: stolen files rather than encrypted systems. Our profile of CL0P ransomware covers the group's wider campaigns, and our guide to SQL injection explains the flaw class.
Integrity means information and systems have not been changed or destroyed in an unauthorized way, whether by an attacker, a faulty process or an honest mistake. A payroll file with a changed bank account number, a log that an intruder edited, and a software update with hidden malicious code are all integrity failures, even if nothing was disclosed and nothing went offline.
The SolarWinds Orion compromise is the best-known integrity attack of recent years. On December 13, 2020, CISA issued Emergency Directive 21-01, ordering federal civilian agencies to disconnect affected Orion products. CISA's alert AA20-352A describes the initial access vector as a supply chain compromise of a library in specific Orion versions, and notes that the actor also abused SAML authentication tokens. The attack worked because customers trusted the integrity of signed vendor software. Confidentiality losses followed, but the starting point was code that had been altered before it ever reached the victims.
Availability means authorized users can reach the information and systems they need, when they need them, with acceptable performance. It is the property customers notice first, because a breach of availability is an outage.
Availability also fails without any attacker: power loss, hardware failure, a bad configuration push or a natural disaster can take systems offline just as effectively.
On May 7, 2021, a ransomware attack on Colonial Pipeline became what CISA's director later called a watershed moment, with images of long lines of cars at gas stations across the eastern seaboard, as CISA recounted in its two-year review of the attack. Ransomware is often described as an availability attack, but modern groups usually steal data before they encrypt it, so a single incident can break confidentiality and availability at the same time.
Most real attacks touch more than one property. The table below shows the main property each common attack targets, what else it often affects, and the control that does the most to stop it.
| Attack | Main property hit | Often also hits | Key controls |
|---|---|---|---|
| Data theft through SQL injection | Confidentiality | Integrity | Parameterized queries, input validation, least-privilege database accounts |
| Credential theft and account takeover | Confidentiality | Integrity | Multi-factor authentication, phishing-resistant sign-in, anomaly alerts |
| Man-in-the-middle interception | Confidentiality | Integrity | TLS everywhere, certificate validation, secure Wi-Fi |
| Software supply chain tampering | Integrity | Confidentiality | Code signing, build pipeline hardening, update verification |
| Business email compromise payment fraud | Integrity | Confidentiality | Out-of-band verification, approval workflows, email authentication |
| Log tampering by an intruder | Integrity | Confidentiality | Central log forwarding, write-once storage, access separation |
| Ransomware | Availability | Confidentiality | Offline or immutable backups, segmentation, endpoint detection |
| DDoS attack | Availability | None directly | Upstream mitigation, rate limiting, redundancy |
| Destructive deletion with stolen admin access | Availability | Integrity | Privileged access management, deletion protection, backups |
For descriptions of each attack type, see our overview of types of cyber attacks.
Controls for one property can weaken another. Encryption protects confidentiality, but losing the key makes the data unavailable. Strict sign-in rules protect confidentiality but can lock out staff during an incident. Heavy integrity checks can slow a system enough to hurt availability. Good security design does not maximize all three everywhere. It decides which property matters most for each system and accepts reasoned trade-offs. That decision is what impact ratings are for.
FIPS 199 turns the triad into a rating method. For each type of information, and then for each system, an organization asks how bad a loss of confidentiality, integrity and availability would be, and rates each one low, moderate or high. Federal agencies must use it; FIPS 199 notes that private-sector critical infrastructure organizations may also use it, and it works well for any company that wants a consistent way to rank systems.
| Impact level | FIPS 199 definition of the adverse effect | Examples from the FIPS 199 amplification |
|---|---|---|
| Low | Limited adverse effect on operations, assets or individuals | Primary functions still work but noticeably less well; minor damage, minor financial loss or minor harm to individuals |
| Moderate | Serious adverse effect | Primary functions significantly less effective; significant damage or financial loss; significant harm to individuals that does not involve loss of life |
| High | Severe or catastrophic adverse effect | One or more primary functions cannot be performed; major damage or financial loss; severe or catastrophic harm, including loss of life |
The result is written as a security category, or SC, with one value per property. FIPS 199 gives a public website as its first example: confidentiality is not applicable because the information is public, while integrity and availability are both moderate. Its second example, sensitive investigative records at a law enforcement agency, rates confidentiality high and integrity and availability moderate. "Not applicable" is allowed only for confidentiality.
The worksheet below is an illustrative example for a mid-size SaaS company, not data from a real organization. It shows how the same company can rate very different systems.
| System or information type | Confidentiality | Integrity | Availability | Reasoning |
|---|---|---|---|---|
| Customer database with personal data | High | Moderate | Moderate | Disclosure triggers breach notification and customer loss |
| Payment and billing ledger | Moderate | High | Moderate | Altered amounts or bank details cause direct financial loss |
| Public marketing website | Not applicable | Moderate | Low | Content is public; defacement harms trust |
| CI/CD pipeline and code signing keys | High | High | Moderate | Tampered builds reach every customer |
| Production application platform | Moderate | High | High | Outage stops revenue and breaks customer commitments |
| Internal wiki | Low | Low | Low | Limited harm if exposed, changed or offline |
A system's overall rating takes the highest value among its three properties. FIPS 200 calls this the high-water mark: a system with any property rated high is a high-impact system. In the federal process, that overall rating selects the low, moderate or high control baseline in NIST SP 800-53B.
For a private company, the same rating has three practical uses. It tells you which systems need the strongest controls, which systems to test first and most deeply, and how to weight vulnerabilities found on each system. The last point connects the triad directly to penetration testing, as the CVSS section below shows.
Most security frameworks are built on the triad, even when they use different labels. Knowing the mapping helps you reuse one set of controls and one set of test results across several audits.
| Framework | How CIA appears | What it means in practice |
|---|---|---|
| ISO/IEC 27001:2022 | Defines information security as preserving confidentiality, integrity and availability; the risk assessment identifies risks of losing each one | Risk register entries, risk treatment and Annex A control choices should trace back to a C, I or A loss |
| SOC 2 (AICPA Trust Services Criteria) | Five categories: security, availability, processing integrity, confidentiality and privacy; security, the common criteria, is in every SOC 2 report | Availability and confidentiality map directly; processing integrity is about complete, accurate, timely and authorized processing, which is narrower than CIA integrity |
| HIPAA Security Rule | Covered entities and business associates must ensure the confidentiality, integrity and availability of all electronic protected health information | Technical safeguards for access control, audit controls, integrity, person or entity authentication and transmission security |
Sources: ISO's description of ISO/IEC 27001; the AICPA's 2017 Trust Services Criteria (with revised points of focus, 2022); and the HIPAA Security Rule at 45 CFR 164.306 and 45 CFR 164.312.
The practical lesson is that auditors ask you to show controls for each property, and attackers test those same controls. A penetration test gives evidence that confidentiality, integrity and availability controls hold under realistic attack, which is why each framework's testing guidance matters. For framework-specific scope and evidence, see our guides to ISO 27001 penetration testing, SOC 2 penetration testing, HIPAA penetration testing and penetration testing for compliance in general. A test supports an audit; it does not by itself make an organization compliant.
The triad is a model, and some security thinkers argue it leaves out important cases. The best-known extension is the Parkerian hexad, proposed by Donn B. Parker in 1998, which keeps the three CIA properties and adds three more, as summarized in the Wikipedia entry on the Parkerian hexad.
| Hexad property | Meaning | Example of a loss that CIA alone describes poorly |
|---|---|---|
| Confidentiality | Information is kept from unauthorized people | Customer records published online |
| Possession or control | The owner keeps control of the information or medium | A thief takes a sealed envelope with a card and PIN but has not opened it yet |
| Integrity | Information is whole, sound and unimpaired | A payroll file with missing rows |
| Authenticity | Information is genuine and correctly attributed | A forged invoice that looks like it came from a real supplier |
| Availability | Information can be accessed in time | A service knocked offline |
| Utility | Information is usable for its purpose | Encrypted backups whose decryption key was lost |
Two of these ideas are already inside the federal definition of integrity, but they are often treated as separate goals. NIST's glossary defines authenticity as the property of being genuine and able to be verified and trusted, and non-repudiation as protection against someone falsely denying an action, such as sending a message or approving a transaction.
They matter most where proof is needed later: payments, contract approvals, code releases, administrative actions and audit trails. Typical controls are digital signatures, strong authentication tied to individual accounts, and tamper-resistant logs. CVSS v4.0 takes the same view: its integrity metric counts a case where a user can deny critical actions, for example because of insufficient logging, as an integrity impact.
The hexad is useful as a checklist when a scenario does not fit cleanly into C, I or A. For ratings, audits and vulnerability scoring, organizations still use the three CIA properties, because the standards and scoring systems are built on them.
When a penetration tester reports a vulnerability, its severity is usually expressed with the Common Vulnerability Scoring System, maintained by FIRST. CVSS rates the impact of a successful exploit on exactly the three CIA properties.
A High confidentiality rating means a total loss of confidentiality on that system, or a disclosure of restricted information with a direct, serious impact, such as an administrator's password or a server's private keys. Low means some restricted information is exposed but the attacker cannot control what, or the loss is limited.
The MOVEit flaw described earlier shows a full CIA impact. The National Vulnerability Database scores CVE-2023-34362 at 9.8 with the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: reachable over the network, no privileges or user action needed, and high impact on all three properties.
The table below shows how common pentest findings are typically rated. These are typical values, not fixed rules; the tester rates what the exploit actually achieves in the tested environment.
| Finding type | Typical confidentiality impact | Typical integrity impact | Typical availability impact | Why |
|---|---|---|---|---|
| SQL injection with read and write access | High | High | Low to High | Database contents can be read and changed; some queries can disrupt service |
| Broken object-level access (IDOR) exposing other users' records | High or Low | None or Low | None | Depends on how sensitive and how controllable the exposed data is |
| Stored cross-site scripting | Low | Low | None | Acts in other users' sessions; the subsequent-system values often carry the impact in v4.0 |
| Cross-site request forgery on an account setting | None | Low or High | None | Forces an unwanted change; High if it allows account takeover |
| Unauthenticated crash of a service | None | None | High | Service stops for all users |
| Exposed backup file containing credentials | High | None | None | Direct disclosure of secrets |
| Missing audit logging for administrator actions | None | Low | None | CVSS v4.0 counts repudiation of critical actions as an integrity impact |
CVSS has a direct link back to your FIPS 199 style ratings. Its Environmental metric group includes Confidentiality, Integrity and Availability Requirements (CR, IR, AR), which record how important each property is for the specific asset where the flaw was found. FIRST's guidance describes the values in the same language as FIPS 199: Low when a loss would have a limited adverse effect, Medium when serious, High when catastrophic. If they are not set, CVSS assumes the worst case and treats them as High, as explained in FIRST's CVSS v4.0 FAQ.
In practice, that means the same flaw should not get the same priority everywhere. A medium-severity disclosure bug on the internal wiki and the same bug on the customer database are different risks, and your categorization worksheet is what lets you score them differently. CVSS describes severity, not likelihood of attack, so most teams also weigh exploitation data. Our comparison of EPSS vs CVSS explains how to combine the two, and our vulnerability management guide covers the wider process. For the web flaws that most often produce high confidentiality and integrity ratings, see our walkthrough of the OWASP Top 10.
The triad is most useful when it drives decisions. A practical sequence for a security or compliance owner:
CIA stands for confidentiality, integrity and availability, the three security objectives defined in U.S. federal law and used by NIST, ISO/IEC 27001 and most security frameworks. It has no connection to the Central Intelligence Agency.
It depends on the system. A hospital records system may rate confidentiality highest, a payment ledger integrity, and a trading platform availability. FIPS 199 exists to make that judgment explicit for each system instead of treating all three as equal everywhere.
No, but it is incomplete on its own. It remains the base for law, standards and vulnerability scoring. Extensions such as the Parkerian hexad, authenticity, non-repudiation, privacy and safety cover cases the three labels describe poorly, and CVSS v4.0 adds safety as a separate consideration.
The CIA triad describes what you protect: confidentiality, integrity and availability. AAA, which stands for authentication, authorization and accounting, describes how access is controlled and recorded. AAA mechanisms are some of the main controls that protect confidentiality and integrity.
Online banking is a common example. Account details should be visible only to the customer and authorized staff (confidentiality), balances and transfers must be accurate and not tampered with (integrity), and customers must be able to log in when they need to (availability).
Encryption of systems is an availability loss. Most modern ransomware groups also steal data before encrypting it, which adds a confidentiality loss, and changes attackers make to systems and backups can affect integrity.
The CIA triad tells you what to protect and how much each loss would hurt. Testing tells you whether your controls actually hold. Once you have rated your highest-impact systems, a penetration test scoped to them shows which confidentiality, integrity and availability controls an attacker could get past.
DeepStrike's penetration testing services start with a planning meeting to agree goals and scope, use manual testing, validate each finding and rate its severity with CVSS, and deliver a report with reproduction steps and remediation guidance, plus an attestation letter. To discuss a specific scope, contact our team.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
