CYBER-01-001-P · Primer — The CIA Triad

The idea in one sentence

The CIA triad names the three goals behind every security decision — Confidentiality, Integrity, and Availability.

Why it exists

"Is this secure?" is too vague to act on. The triad turns it into three concrete questions. Picture a medical record: you want only the right people to read it (confidentiality), you want it to stay accurate and untampered (integrity), and you want the doctor to reach it in an emergency (availability). Almost any security requirement you will ever write is one of those three wishes in disguise, so the triad gives you a shared vocabulary for stating what you are actually protecting.

How it works

Each goal has a plain meaning and a family of controls that serve it. Confidentiality — only authorized parties can read the data; served by encryption and access control. Integrity — the data is accurate and unaltered; served by hashes, signatures, and checksums. Availability — the data and service are there when needed; served by backups, redundancy, and failover. Given any control, you can ask which of the three it defends — and that is usually how you decide whether you even need it.

The one gotcha

The three goals pull against each other, so most controls trade one for another — you rarely maximize all three at once. Encrypt a database and confidentiality soars, but the data is now only as reachable as the key: lose that key, or let it expire on a Saturday, and the ciphertext is unrecoverable. That is perfect confidentiality and zero availability from a single control. Security is never "max everything" — it is choosing the right balance for each asset and defending that balance.

See it (visualization plan)

A LayersScene shows the encryption trade — "Encrypt the database → confidentiality ↑" over "Data only as reachable as the key → availability at risk" — then a BigNumberScene drives Availability from 100 to 0 after the key is lost.

See it — A simple diagram of the CIA Triad and its key controls

flowchart TD
    CIA["CIA Triad"]
    C["Confidentiality<br/>Encryption<br/>Access Control"]
    I["Integrity<br/>Hashes<br/>Signatures<br/>Checksums"]
    A["Availability<br/>Backups<br/>Redundancy<br/>Failover"]
    CIA --> C
    CIA --> I
    CIA --> A

The one-line takeaway

Every control trades one goal for another — know which.

Where you'll meet it

The triad frames every risk review, threat model, and audit you will sit in, and it is the yardstick for judging any control you propose. NIST SP 800-12 introduces it as the foundation of information security; you will see the same three letters behind access reviews, backup policies, and integrity monitoring for the rest of your career.

Named concepts: CIA triad, confidentiality, integrity, availability