What Is the CIA Triad? Confidentiality, Integrity, Availability
Almost every cybersecurity control, from a password to a firewall to a backup, exists to protect one of three things: confidentiality, integrity, or availability. Together these three goals are called the CIA Triad, and they are the mental model professionals use to reason about security.
The name has nothing to do with the intelligence agency. Once you can see which pillar a threat attacks, the right defense usually becomes obvious. This guide explains each pillar with everyday examples.
Confidentiality: keeping secrets secret
Confidentiality means only the people who are supposed to see information can see it. A data breach that leaks customer records is a confidentiality failure.
The everyday tools of confidentiality are access controls, encryption, and simple habits like locking your screen.
- Encryption protects confidentiality when a device is lost or traffic is intercepted.
- Least privilege, giving people access only to what they need, limits who can see what.
- Multi-factor authentication keeps a stolen password from unlocking your data.
Integrity: keeping data trustworthy
Integrity means information is accurate and has not been tampered with. If an attacker changes a bank balance, alters a medical record, or swaps the bank details on an invoice, that is an integrity attack, even if nothing was stolen or leaked.
Integrity controls detect or prevent unauthorized changes.
- Hashing and digital signatures prove a file or message was not altered in transit.
- Version history and audit logs reveal who changed what, and when.
- Input validation stops attackers from corrupting data through an app.
Availability: keeping systems up
Availability means the data and systems are there when authorized people need them. A ransomware attack that encrypts your files, or a denial-of-service attack that knocks a website offline, is an availability attack.
Availability is easy to forget until it fails, and then it is all anyone cares about.
- Backups following the 3-2-1 rule restore availability after ransomware or hardware failure.
- Redundancy and failover keep services running when one part breaks.
- Patching and capacity planning prevent avoidable outages.
Why the triad is useful
The triad is a checklist for thinking. When you evaluate any system or decision, ask: how do we protect confidentiality, integrity, and availability, and which one matters most here?
The three often trade off. Locking data down hard for confidentiality can make it slower to reach, which hurts availability. Good security balances all three for the situation.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
One ransomware attack, all three pillars at once
A clinic was hit by ransomware. The attackers first copied patient records and threatened to publish them, then encrypted the clinic systems and demanded payment.
In a single incident, confidentiality failed because records were stolen, availability failed because systems were locked, and the threat to alter or destroy records put integrity at risk too.
- Most real attacks hit more than one pillar. Modern ransomware steals data (confidentiality) and encrypts it (availability), which is why backups alone are no longer enough.
- Map defenses to pillars. Encryption protects the confidentiality of stolen data, offline backups protect availability, and audit logs protect integrity. Each pillar needs its own control.
- The triad shows you what is missing. If you can explain how you protect availability but not the other two, you have just found your gap.
Test yourself
Test your grasp of the fundamentals, free.
Frequently asked questions
What does CIA stand for in cybersecurity?
Confidentiality, Integrity, and Availability. It has nothing to do with the intelligence agency; it is the three core goals that security controls are designed to protect.
Which part of the CIA Triad is most important?
It depends on the context. A hospital may prioritize availability so systems work in an emergency, a bank may prioritize integrity so balances are correct, and a law firm may prioritize confidentiality. Good security balances all three.
Is the CIA Triad still relevant today?
Yes. Newer models add goals like authenticity and non-repudiation, but confidentiality, integrity, and availability remain the foundation taught in every security course and used in real risk decisions.