Security Objectives: Confidentiality, Integrity and Availability

Together they are known as the "CIA triad". Every control in an ISMS supports at least one of them. So the triad is a shared yardstick for tech, staff and management.

The three objectives at a glance

Confidentiality

Confidential data is only seen by the people, systems or processes that are allowed to see it. Typical threats are data leaks, tapped connections and access rights that are too broad.

Common controls include:

• Role and permission concepts based on need to know
• Encryption of data in transit and at rest
• Strong sign-in, for example with multi-factor authentication
• Classification of information, such as "internal" or "confidential"

Read more in the entry on confidentiality.

Integrity

Data with integrity is correct and complete. Nobody has changed it without the right to do so, or without being noticed. Risks come from tampering and malware, but also from simple mistakes.

Common controls include:

• Checksums and digital signatures
• Change logs that show who changed what
• Four-eyes principle for critical changes
• Write access only for the roles that really need it

Read more in the entry on integrity.

Availability

Data and systems are ready when the right users need them. Outages come from hardware faults, power cuts, ransomware or DDoS attacks.

Common controls include:

• Regular backups that you can actually restore
• Redundant systems and network links
• Monitoring and maintenance before something fails
• Emergency and recovery plans

Read more in the entry on availability.

Security objectives in ISO 27001

ISO/IEC 27000 holds the terms for the ISO 27000 family. It defines information security as preserving the confidentiality, integrity and availability of information. ISO/IEC 27001 sets the requirements for an ISMS that protects these three properties.

In an ISO 27001 risk assessment, you ask one question for each type of data: what happens if one of the three goals is lost? The answers show the risks. They also point to the right controls in Annex A.

The standard also mentions further properties that can matter, depending on the organization:

• Authenticity: information or a communication partner is genuine.
• Non-repudiation: an action cannot be denied later.
• Accountability: an action can be traced to one person or system.
• Reliability: a system behaves as intended.

These extra goals mostly support one of the three core ones. Authenticity, for example, helps keep data both secret and correct.

Security objectives in BSI IT-Grundschutz

The BSI IT-Grundschutz calls the three objectives its "basic values". When you set protection needs, you rate each object. How much harm would the loss of each value cause? The BSI uses the categories "normal", "high" and "very high". The higher the protection need, the stronger the controls must be.

Security objectives in the GDPR

The GDPR also uses these objectives. Article 32 requires technical and organizational measures that ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. If you handle personal data, the law asks you to meet these goals too.

Core objectives vs. your own security objectives

The terms sound alike but mean different things:

• The core objectives are general and apply to every organization: confidentiality, integrity and availability.
• Information security objectives are set by each organization itself. ISO/IEC 27001 requires them in clause 6.2.

The standard says these objectives must fit the security policy. They should be measurable where you can. You must also track them, share them, update them as needed and write them down. For each one, you plan what will be done and who is in charge. You also plan the resources, the deadline and how you will check the result.

An example of such an objective: "Critical security updates are installed on all servers within 14 days." This objective mainly serves integrity and availability.

How to put the objectives into practice

1. List your information assets: which data, systems and processes matter to your business?
2. Rate the protection need: how bad would a loss of confidentiality, integrity or availability be?
3. Assess the risks: which threats and weaknesses put the objectives at risk?
4. Implement controls: choose technical and organizational measures that fit the risk.
5. Check that they work: internal audits and metrics show whether the controls are effective.

These steps are the core of an information security management system (ISMS).

Frequently asked questions

How many security objectives are there?

The three classic objectives are confidentiality, integrity and availability. Depending on the standard and sector, others are added, such as authenticity, non-repudiation or accountability.

Which objective matters most?

That depends on the asset. For patient data, keeping it secret often comes first. For a production line, uptime is usually key. Your protection needs show which goal weighs most in each case.

Are the security objectives required by law?

For personal data, yes: Article 32 of the GDPR names confidentiality, integrity and availability explicitly. Rules such as NIS2 also require measures that protect these objectives.