1.2 Security and Privacy Objectives: CIA, Non-Repudiation and Privacy Concepts
Key Takeaways
- FISMA (44 U.S.C. 3552) and FIPS 199 recognize exactly three security objectives — confidentiality, integrity, and availability — and every FIPS 199 impact rating is assigned against one of those three, never against non-repudiation or privacy.
- Non-repudiation is an assurance property built from integrity plus strong authentication and independent logging (AU-10), not a fourth member of the CIA triad.
- Privacy risk is not a subset of security risk: a system can be perfectly confidential and still create privacy harm through authorized but problematic data processing.
- NISTIR 8062 defines three privacy engineering objectives — predictability, manageability, and disassociability — that complement rather than replace the CIA triad.
- On the exam, map the described harm to the objective it violates first, then select the control family; picking the objective correctly resolves most Domain 1 and Domain 2 scenario items.
Security and Privacy Objectives: CIA, Non-Repudiation and Privacy Concepts
Almost every downstream CGRC activity — categorizing a system, selecting a baseline, writing an assessment objective, rating a finding — depends on correctly naming which objective a harm violates. Candidates who blur these terms lose points across Domains 1, 2, 3, and 5, because the exam repeatedly describes a business consequence and asks which objective, control, or document responds to it.
1. The Three Statutory Security Objectives
FISMA, codified at 44 U.S.C. § 3552, and FIPS 199 define exactly three security objectives. This is a closed list. Nothing else — not authenticity, not non-repudiation, not privacy — is a FIPS 199 objective, and no impact level is ever assigned to anything outside these three.
| Objective | Statutory Definition (44 U.S.C. § 3552) | Failure Looks Like | Representative SP 800-53 Families |
|---|---|---|---|
| Confidentiality | "Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information." | A misconfigured storage bucket exposes claimant records to the open internet. | AC (Access Control), SC (System and Communications Protection), MP (Media Protection) |
| Integrity | "Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity." | A payroll table is silently altered, so benefit calculations are wrong but the system stays online. | SI (System and Information Integrity), CM (Configuration Management), AU (Audit and Accountability) |
| Availability | "Ensuring timely and reliable access to and use of information." | A ransomware event encrypts the dispatch database; the data is intact and secret, but unusable. | CP (Contingency Planning), SC, MA (Maintenance) |
[!IMPORTANT] Read the statutory text of Integrity carefully: it explicitly folds in "non-repudiation and authenticity." That is the exam's single favourite trap in this area. Non-repudiation is a component of the integrity objective, not a fourth objective. If an item offers "non-repudiation" as a FIPS 199 impact category, it is a distractor.
Distinguishing the Objectives Under Pressure
Exam scenarios deliberately describe events that touch more than one objective. Use this discriminator:
- Ask "what did the adversary or failure actually change?"
- Someone saw data they should not have → Confidentiality.
- Someone changed or destroyed data, or the data can no longer be trusted → Integrity.
- Nobody saw or changed anything, but authorized users cannot reach the data or service → Availability.
A ransomware incident that both exfiltrates and encrypts data violates confidentiality and availability, and — if files were corrupted — integrity as well. FIPS 199 handles this by rating each objective separately rather than forcing a single label.
2. Non-Repudiation, Authenticity and Accountability
These three assurance properties are built on top of the triad. They are essential CGRC vocabulary, but they are not categorization inputs.
| Property | Definition | How It Is Achieved | Anchor Control |
|---|---|---|---|
| Authenticity | Confidence that data, a transaction, or a sender is genuine and is what it claims to be. | Cryptographic signatures, certificate validation, multifactor authentication. | IA-2, SC-23 |
| Non-Repudiation | Assurance that an actor cannot credibly deny having performed an action or originated a message. | Digital signatures bound to a verified identity, plus tamper-resistant, independently retained audit records. | AU-10 (Non-repudiation), AU-9 |
| Accountability | The ability to trace an action uniquely back to a single responsible individual. | Unique (non-shared) accounts, comprehensive audit logging, separation of duties. | AC-2, AU-2, AU-6 |
Non-repudiation requires three ingredients simultaneously: a strongly authenticated identity, an integrity-protected record of the action, and custody of that record by a party who cannot alter it. Remove any one and repudiation becomes credible. This is precisely why shared administrator accounts destroy non-repudiation even when every log is perfectly retained — the record is intact, but it cannot be bound to a person.
[!NOTE] Why shared accounts are a governance failure, not just a technical one. If four engineers share
root, the audit trail proves that a change occurred but not who made it. Accountability collapses, non-repudiation collapses with it, and the organization loses its ability to enforce consequences — which is a governance defect the CGRC expects you to flag.
3. Privacy Is Not a Subset of Security
The most consequential conceptual shift in NIST SP 800-37 Rev. 2 was elevating privacy to a first-class discipline alongside security throughout the entire life cycle. The exam tests whether you understand why they are distinct.
Security risk arises from unauthorized system behaviour — a breach, an intrusion, a corruption event.
Privacy risk arises from authorized data processing that nonetheless creates problems for individuals. NIST calls these problematic data actions. No attacker is required and no control has failed.
Concrete example: a transit agency lawfully collects fare-card tap data to bill riders. The system is fully encrypted and never breached. But the agency then reuses that data to reconstruct individual travel histories and share them with a third party. Zero security failures. Serious privacy harm. Confidentiality controls cannot detect this, because the disclosure was authorized.
The Privacy Engineering Objectives (NISTIR 8062)
Because the CIA triad cannot express privacy outcomes, NIST defined three complementary objectives:
| Privacy Objective | Meaning | Design Implication |
|---|---|---|
| Predictability | Individuals, owners, and operators can reliably anticipate how data will be handled. | Published notices, documented purpose limitation, no undisclosed secondary use. |
| Manageability | Data can be granularly administered — corrected, deleted, or selectively disclosed. | Records-management tooling, honoring correction and deletion requests. |
| Disassociability | The system processes data without associating it with individuals beyond operational need. | De-identification, tokenization, aggregation, differential privacy. |
PII and the Fair Information Practice Principles
Personally Identifiable Information (PII) is any information that can be used to distinguish or trace an individual's identity, alone or when combined with other available information. That second clause matters: a ZIP code alone is not PII, but ZIP code plus birth date plus sex is famously re-identifying, so aggregation raises both the privacy risk and, often, the confidentiality impact level.
The Fair Information Practice Principles (FIPPs) — transparency, individual participation, purpose specification, data minimization, use limitation, data quality and integrity, security, and accountability — are the policy ancestors of every modern privacy regime, including the GDPR and the Privacy Act of 1974. In NIST SP 800-53 Rev. 5 they are operationalized primarily through the PT (Personally Identifiable Information Processing and Transparency) family, supported by PM controls at the organizational tier.
4. Exam Traps to Memorize
- "Which FIPS 199 objective does non-repudiation map to?" → Integrity. It is never its own objective.
- "The data was encrypted, so there is no privacy risk." → False. Encryption addresses confidentiality; problematic data actions by authorized parties remain.
- "Privacy controls are selected from the FIPS 199 high-water mark." → False. Privacy control selection is driven by a privacy risk assessment and the presence of PII processing, independent of the security baseline.
- "Availability is the least important objective." → Never assume a hierarchy. For a 911 dispatch or life-safety system, availability is routinely the High objective that drives the entire baseline.
A contractor argues that because a benefits system encrypts all records at rest and in transit and has never suffered a breach, the agency has no privacy risk to document. Why is this reasoning fundamentally flawed?
An organization retains complete, tamper-evident audit logs, but all four platform engineers authenticate to production using a single shared administrative account. Which assurance property is most directly defeated by this practice?
Under FIPS 199 and 44 U.S.C. § 3552, how is non-repudiation treated within the federal security categorization scheme?