2.1 The CIA Triad
Key Takeaways
- The CIA triad — Confidentiality, Integrity, and Availability — is the foundational model of information security and the lens ISO/IEC 27001 uses to scope risks and select controls.
- Confidentiality limits access to authorized parties; encryption, access control, and clearances protect it, while overshared spreadsheets and stolen credentials breach it.
- Integrity ensures information is accurate and unaltered; hashing, change management, and segregation of duties protect it, and unauthorized modification (even of public data) is still an integrity breach.
- Availability ensures information is accessible when needed; backups, redundancy, and capacity planning protect it, and DoS/DDoS attacks target availability rather than confidentiality.
- Annex A controls cluster around each CIA dimension: A.5.15 access control and A.8.24 cryptography for confidentiality, A.5.33 test data and A.8.3 information access restriction for integrity, A.8.13 backups and A.8.14 redundancy for availability.
Almost every information security objective, control, and exam question traces back to three properties: Confidentiality, Integrity, and Availability — the CIA triad. ISO/IEC 27001 does not invent a new model; it builds an entire management system around protecting these three properties for the information assets an organization values. If you can classify a scenario into which leg of the triad is threatened, you can usually identify the correct control family on the exam.
Why the Triad Matters on the Foundation Exam
The PECB ISO/IEC 27001 Foundation exam tests whether you can:
- Recognize which CIA property a threat targets.
- Map Annex A controls to the property they protect.
- Spot the deliberate distractor that confuses integrity with confidentiality, or availability with integrity.
Confidentiality
Confidentiality is the property that information is not made available or disclosed to unauthorized individuals, entities, or processes.
What it protects
Confidentiality prevents disclosure. It applies to personal data, trade secrets, authentication credentials, board minutes, customer lists, and any information whose value depends on remaining secret.
Mechanisms that protect confidentiality
| Mechanism | Annex A reference |
|---|---|
| Role-based access control | A.5.15 Access control |
| Encryption at rest and in transit | A.8.24 Use of cryptography |
| Need-to-know and least privilege | A.5.18 Access rights |
| Physical entry controls | A.7.2 Physical entry |
| NDAs and confidentiality clauses | A.5.37 Classified information |
Example and counter-example
- Example breach: An employee downloads a customer database to a personal USB drive and sells it. Confidentiality is violated.
- Counter-example: A company publishes its quarterly earnings press release. Wide disclosure is the intended state, so confidentiality is not in play — though integrity and availability still are.
Integrity
Integrity is the property of accuracy and completeness. Information has integrity when it has not been altered in an unauthorized or unintended way, whether by a person, a system fault, or a process error.
What it protects
Integrity protects correctness. Tampered accounting records, a changed medical prescription, a silently modified audit log, or a software build injected with malicious code all compromise integrity — even if no one else ever saw the data.
Mechanisms that protect integrity
| Mechanism | Annex A reference |
|---|---|
| Hashing and digital signatures | A.8.24 Use of cryptography |
| Change management | A.8.32 Change management |
| Segregation of duties | A.5.3 Segregation of duties |
| Logging and monitoring | A.8.15 Logging |
| Input validation and testing | A.8.28 Secure coding |
Example and counter-example
- Example breach: A database administrator is bribed to inflate a vendor invoice amount from $4,200 to $42,000. No external disclosure occurs, but integrity is broken.
- Counter-example: A public web page is intentionally updated with new pricing. Authorized change is not an integrity violation; unauthorized or erroneous change is.
Exam trap: Students often classify "hacker defaces a public website" as a confidentiality breach because the site is public. It is an integrity breach — the issue is unauthorized modification, not disclosure.
Availability
Availability is the property of being accessible and usable upon demand by an authorized entity.
What it protects
Availability ensures the business can keep running. Ransomware that encrypts production systems, denial-of-service (DoS / DDoS) attacks, hardware failures, power outages, and natural disasters all threaten availability.
Mechanisms that protect availability
| Mechanism | Annex A reference |
|---|---|
| Backups and restoration testing | A.8.13 Information backup |
| Redundancy and failover | A.8.14 Redundancy of information processing facilities |
| Capacity management | A.8.6 Capacity management |
| Malware protection | A.8.7 Protection against malware |
| Business continuity and ICT readiness | A.5.29 ICT readiness for business continuity |
Example and counter-example
- Example breach: A distributed denial-of-service (DDoS) attack floods an e-commerce site until it stops responding. Availability is the targeted property; confidentiality and integrity may be untouched.
- Counter-example: A planned system outage for weekend maintenance, with communicated windows and fallback procedures, is not an availability failure in the security sense — it is a managed, authorized reduction of service.
How ISO/IEC 27001 Maps Controls to the Triad
ISO/IEC 27001 Annex A is not formally labeled by CIA dimension, but controls naturally cluster:
graph LR
C["Confidentiality"] --- A1["A.5.15 Access control<br/>A.8.24 Cryptography<br/>A.7.2 Physical entry"]
I["Integrity"] --- A2["A.5.3 Segregation of duties<br/>A.8.32 Change management<br/>A.8.15 Logging"]
A["Availability"] --- A3["A.8.13 Backup<br/>A.8.14 Redundancy<br/>A.8.6 Capacity"]
style C fill:#1e3a5f,color:#fff
style I fill:#2d5a87,color:#fff
style A fill:#c9a227,color:#1e3a5f
When the exam gives you a scenario ("a hospital loses power and patient records become unreachable"), identify the property first (availability), then pick the matching control family (A.8.14 redundancy, A.5.29 ICT readiness).
Common Exam Traps
- "Public data can't be attacked." Wrong. Public data can still be tampered with (integrity) or taken offline (availability).
- "Backups protect integrity." Backups primarily protect availability; they help recover integrity after corruption but the protective property is restoring access.
- "DDoS is a confidentiality attack." No disclosure occurs; it is an availability attack.
- "Encryption solves everything." Encryption addresses confidentiality (and can support integrity via authenticated encryption), but it does not by itself guarantee availability.
- Confusing integrity with authenticity. Authenticity is about who originated the data (covered in 2.2); integrity is about whether the data is unaltered. Related but distinct.
A breach at a payroll vendor exposes employees' bank account numbers to an attacker. Which CIA property is primarily violated?
An attacker changes the published price of a product on a public e-commerce site from $99 to $0.99. Which CIA property is violated?
Which Annex A control pair most directly supports the availability of information processing facilities?