Quick answer: The CIA triad is the core model of cyber security. Confidentiality means only authorized people can access information, integrity means information stays accurate and is not altered without detection, and availability means systems and data are accessible when needed. Almost every security control protects at least one of the three.
The triad gives security teams a common language for describing risk. A data leak is a confidentiality failure, a tampered payment record is an integrity failure and a ransomware outage is an availability failure. This guide explains each goal, the threats to it and the controls that protect it.
The CIA triad at a glance
| Goal | Typical threats | Example controls |
|---|---|---|
| Confidentiality | Data breaches, eavesdropping, stolen credentials | Encryption, access control, MFA, data loss prevention |
| Integrity | Tampering, malware, unauthorized changes | Hashing, digital signatures, change control, audit logs |
| Availability | Ransomware, DDoS attacks, hardware failure | Backups, redundancy, DDoS protection, patching |
The three goals often pull against each other. Very strict access controls improve confidentiality but can reduce availability, so security design is about finding the right balance for each system.
Confidentiality
Confidentiality protects information from people who should not see it. NIST describes it as preserving authorized restrictions on access and disclosure, in its glossary definition. Key controls are encryption, strong authentication, least-privilege access and data classification. See symmetric vs asymmetric encryption and our guide to data loss prevention.
Integrity
Integrity ensures data is complete and trustworthy. Attackers who alter records, inject code or change configurations break integrity even if nothing is stolen. Hashes, digital signatures, version control and detailed audit logs help detect and prevent unauthorized changes.
Availability
Availability keeps systems running for the people who depend on them. Ransomware is now one of the most damaging availability threats, alongside denial-of-service attacks and simple hardware failure. Tested backups, redundancy and fast patching are the main defenses; see our ransomware guide and managed cloud backup guide.
How to apply the CIA triad
- Classify your data and systems by how sensitive and critical they are.
- For each, decide which of the three goals matters most.
- Choose controls that protect those goals; our overview of types of security controls can help.
- Use the triad to describe the impact of incidents in risk assessments.
The triad also underpins wider frameworks and objectives; read about cyber security objectives and layered security. US federal systems categorize impact on each of the three goals under FIPS 199.
Frequently asked questions
What does CIA stand for in cyber security?
CIA stands for confidentiality, integrity and availability, the three main goals of information security.
What is an example of availability in cyber security?
Keeping an online banking service running during a denial-of-service attack, or restoring files from backup after ransomware, are examples of protecting availability.
What is an example of a confidentiality breach?
An attacker stealing customer records, or an employee emailing sensitive files to a personal account, are confidentiality breaches.
Is the CIA triad still relevant?
Yes. Some models add properties such as authenticity and non-repudiation, but confidentiality, integrity and availability remain the foundation.
Conclusion
The CIA triad is simple but powerful. Ask which of the three goals each system needs most, choose controls to protect it and use the same language to explain risk to leaders. It is the quickest way to make security decisions consistent.
