The CIA triad is the foundational model of information security that defines its three core objectives: confidentiality, integrity and availability of information and the systems that process it. In cybersecurity and security fundamentals, it serves as the common vocabulary for classifying assets, analyzing risks and selecting controls, because almost every security incident can be described as a failure of one or more of these three properties.
The model appears, in slightly different wording, in ISO/IEC 27000, in the US federal standard FIPS 199 and in most security frameworks and certifications. Its strength is simplicity; its limitation is that it describes what to protect, not how to prioritize between goals that often pull in different directions.
The three properties of the CIA triad
Each property of the CIA triad answers a different question about information: who may see it, whether it can be trusted and whether it can be used when needed. The table summarizes the formal meaning, typical threats and representative controls for each property.
| Property | Formal meaning | Typical threats | Representative controls |
|---|---|---|---|
| Confidentiality | Information is not disclosed to unauthorized individuals, entities or processes | Data breaches, eavesdropping, misconfigured storage | Encryption, access control, data classification |
| Integrity | Information is accurate and complete and is not altered in an unauthorized way | Tampering, injection attacks, silent corruption | Hashing, digital signatures, change control |
| Availability | Information and systems are accessible and usable on demand by authorized users | Denial of service, ransomware, hardware failure | Redundancy, backups, capacity planning |
Confidentiality is broader than secrecy: it includes privacy obligations and the principle that access is granted on a need-to-know basis. Integrity covers both data and systems, so an attacker who silently changes a configuration file violates integrity even if no business record is touched. Availability is measured against agreed service levels, which makes it the most quantifiable of the three.
Related Terms in security fundamentals build on the triad. A threat model asks which property an adversary is likely to attack, the attack surface describes where such attacks can start, and least privilege is one of the most effective controls for confidentiality and integrity at the same time.
How controls map to the triad
Most security controls protect more than one property, and some strengthen one while weakening another. Mapping controls to the triad shows coverage gaps and prevents the false assumption that a single measure such as encryption solves security as a whole.
| Control | Confidentiality | Integrity | Availability |
|---|---|---|---|
| Encryption at rest and in transit | Primary | Supporting with authenticated modes | Risk if keys are lost |
| Multi-factor authentication | Primary | Primary | Minor risk of lockouts |
| Cryptographic hashes and signatures | None | Primary | None |
| Offline, tested backups | Risk if backups are unprotected | Supporting through restore points | Primary |
| Redundant infrastructure | None | None | Primary |
| Logging and monitoring | Detective | Detective | Detective |
The table shows a recurring pattern: preventive controls usually favor one property, while detective controls such as logging support all three by revealing incidents early. A balanced security program combines both and checks that every critical asset has at least one strong control for each property that matters to it.
Classifying impact with the CIA triad
In practice, the triad is used to rate the business impact of losing each property for a given information system. FIPS 199 defines three impact levels for each objective: low, moderate and high, corresponding to limited, serious and severe or catastrophic adverse effects on operations, assets or individuals.
The ratings differ sharply between systems. A public marketing website has low confidentiality impact because its content is already public, but a defaced page harms reputation, so integrity matters. A clinical record system rates high on all three properties, because disclosure, alteration or outage can each harm patients.
Availability ratings are often translated into service level targets. The following table converts common availability percentages into the maximum downtime they allow in a 365-day year, which helps align the abstract property with engineering decisions.
| Availability target | Maximum downtime per year | Typical use |
|---|---|---|
| 99% | About 3.65 days | Internal tools with business-hours use |
| 99.9% | About 8.76 hours | Standard business applications |
| 99.99% | About 52.6 minutes | Customer-facing and payment services |
| 99.999% | About 5.26 minutes | Telecommunications and critical infrastructure |
Each additional nine reduces permitted downtime by a factor of ten and typically raises cost substantially, because it requires redundancy across components, sites and operating teams. Availability planning also uses the recovery time objective and recovery point objective, which state how fast a service must return and how much data loss is tolerable.
Trade-offs between confidentiality, integrity and availability
The three properties frequently compete with each other, and good security design makes these conflicts explicit instead of maximizing one property by default. The table lists typical decisions and their effect on the triad.
| Design decision | Strengthens | Weakens or risks |
|---|---|---|
| Encrypting all data with a single key holder | Confidentiality | Availability if the key is lost |
| Replicating data to many sites | Availability | Confidentiality through a larger attack surface |
| Strict account lockout after failed logins | Confidentiality | Availability through deliberate lockout attacks |
| Mandatory approval for every change | Integrity | Availability when urgent fixes are delayed |
| Fail-open behavior of a security gateway | Availability | Confidentiality and integrity during the failure |
The right balance depends on the asset. A safety system in an industrial plant usually puts availability and integrity first, whereas a vault of encryption keys puts confidentiality first and accepts more downtime risk. Documenting this priority per system is one of the most useful outputs of a risk assessment.
Extensions and criticism of the model
The CIA triad is deliberately minimal, and several models extend or invert it. The attacker’s mirror image is the DAD triad: disclosure, alteration and destruction or denial. Other models add properties that the triad covers only indirectly.
| Model | Properties | What it adds |
|---|---|---|
| CIA triad | Confidentiality, integrity, availability | The baseline set of security objectives |
| DAD triad | Disclosure, alteration, destruction or denial | The attacker’s view of the same three failures |
| Parkerian hexad | CIA plus possession, authenticity and utility | Distinguishes loss of control from disclosure and usable from merely available data |
| ISO/IEC 27000 extended properties | Authenticity, accountability, non-repudiation, reliability | Properties needed for transactions, auditing and legal evidence |
A common criticism is that the triad says nothing about who is responsible, how much to spend or which risk to accept. It is therefore a classification tool, not a complete security strategy. Another frequent mistake is treating it as purely technical, while many violations stem from process failures and human error, such as a misaddressed email or an unreviewed change.
Stripped to the essentials
The CIA triad says that protecting information means three things at once. Only the right people can see it, nobody can change it without permission, and it is there when someone needs it.
Think of a bank safe-deposit box. It must stay closed to strangers, its contents must not be swapped, and the owner must be able to open it during business hours. If any one of these fails, the box has failed. Every security measure protects at least one of these three goals, and the hard part is balancing them.
Where it is applied
A regional hospital with about 400 beds runs a yearly risk assessment and rates each information system against the CIA triad. The electronic health record is rated high for confidentiality, integrity and availability, because a leak harms patient privacy, a wrong allergy entry can cause injury and an outage stops clinical work. The public website is rated low for confidentiality and moderate for integrity and availability.
These ratings drive concrete decisions. The health record receives encryption, role-based access and audit logging for confidentiality and integrity, plus a 99.99% availability target with a standby site and a recovery time objective of one hour. When a ransomware infection later encrypts several file servers, the record system keeps running from the standby site, and offline backups restore the file servers within two days. The assessment had identified availability as the weakest property, and the investment based on it limited the impact of the incident.