What is the CIA triad?
The CIA triad breaks the question of whether information is secure into three questions that can be checked separately: who may see it? Is it correct and unaltered? Is it there when it is needed?
The glossary of the BSI's IT-Grundschutz Compendium (2023 edition) states that the protection goals, or basic values, of information security are confidentiality, integrity and availability. ISO/IEC 27001 requires risks to be identified as the loss of these three properties for the information in scope.
The protection goals are not the same as information security objectives under clause 6.2 of ISO/IEC 27001:2022, which are measurable objectives of the ISMS.
| Protection goal | Guiding question | Example of a breach | Controls that support it |
|---|---|---|---|
| Confidentiality | Who may see the information? | Customer data sits on a drive every employee can read | Access control on the need-to-know principle, encryption, data classification |
| Integrity | Is the information correct and unaltered? | A supplier's bank details are changed without anyone noticing | Four-eyes principle, logging, checksums and signatures, narrowly scoped change rights |
| Availability | Is the information there when it is needed? | Ransomware encrypts the ERP system during the month-end close | Backup, redundancy, business continuity management, patch management |
The BSI glossary expressly extends integrity to details such as author or time of creation; an aborted batch run violates it just as an attacker does. Availability is measured against business need, not uptime: a system with high annual availability misses the goal if the outage falls in the month-end close. How long a process can tolerate an outage is determined by the business impact analysis.
Are there 4 or 5 protection goals of information security?
There is no fixed number. Alongside the three basic values, BSI Standard 200-1 names authenticity, binding force (Verbindlichkeit), reliability, resilience and non-repudiation as further basic values that can be helpful in individual cases. According to the BSI glossary, binding force combines authenticity and non-repudiation. Whether a source speaks of four, five or six protection goals depends on which of these extensions it includes.
The extended goals refine the triad. Authenticity matters where origin is decisive, for example for software updates or payment instructions by email; non-repudiation matters where an approval or order must later be proven to third parties. Keep only the goals you actually rate for every asset.
Rating separately: an example with three kinds of information
Under BSI Standard 200-2, each application and the information it processes is examined for the damage that impaired confidentiality, integrity or availability could cause, and assigned to the categories normal, high and very high. The procedure is described in the entry protection needs assessment.
Fictional example: a retailer rates three kinds of information. The ratings are invented for illustration.
| Information | Confidentiality | Integrity | Availability | What follows |
|---|---|---|---|---|
| Product catalog in the web shop | normal | high | high | approval for price changes and fast restoration; encryption for confidentiality is not needed |
| Personnel files | very high | high | normal | narrow read rights and encryption; an outage of two days is tolerable |
| Supplier bank details | high | very high | high | four-eyes principle for every change, logged changes, call-back to the supplier before the first payment |
With one overall rating of “high” for all three, you could no longer justify why the catalog needs no encryption and the personnel files no emergency operation. Check your ratings like this: every rating names a damage scenario, and every control can be traced back to at least one rating. The article protection needs instead of gut feeling shows how to justify damage scenarios and thresholds. The guide implementing an ISMS shows where this fits when you build an ISMS.
Where do the protection goals appear in law?
The three protection goals sit inside several legal terms in German and EU law; none of the provisions uses the word “triad”.
| Source | Provision | How the protection goals appear |
|---|---|---|
| BSIG | § 2 no. 39 | “Security in information technology” means compliance with security standards concerning the availability, integrity or confidentiality of information (our translation) |
| BSIG | § 2 no. 40 | A security incident is an event that impairs the availability, integrity or confidentiality of data or services |
| BSIG | § 30(1) sentence 1 | Particularly important entities (besonders wichtige Einrichtungen; “essential entities” in the NIS2 Directive) and important entities take measures to avoid disruptions to the availability, integrity and confidentiality of their systems |
| GDPR | Article 5(1)(f) | Principle of “integrity and confidentiality” in the processing of personal data |
| GDPR | Article 32(1)(b) | Ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services |
Whether an event is a security incident is therefore decided by the protection goals. For particularly important and important entities, this is the entry point to the reporting duty under § 32 BSIG, which applies to significant security incidents. Under § 28(5) and (6) BSIG, §§ 30 and 32 do not in principle apply to operators of public telecommunications networks, certain energy companies and financial entities under DORA. In the GDPR (Regulation (EU) 2016/679), Article 32 adds the resilience of systems.
Trade-offs: the three goals cannot all be maximized at once
A control that strengthens one protection goal can weaken another:
- Encryption increases confidentiality. If the key material is lost, the data is no longer available.
- A strict four-eyes principle strengthens integrity and slows every process that needs to be fast.
- Additional backups improve availability and create further copies whose confidentiality must be protected.
- Strict access restrictions serve confidentiality and can delay recovery during an outage if emergency access is missing.
The protection needs settle such conflicts. Where availability is rated very high and confidentiality normal, the trade-off differs from the reverse case.
How Rizzqo carries the protection goals on the asset
Rizzqo carries the protection goals where protection needs arise: on the primary asset. Primary assets of type process or service are rated for confidentiality, integrity and availability, primary assets of type information for confidentiality only; the personal-data flag is added.
Supporting assets such as servers, applications and services obtained from providers inherit only the confidentiality rating and the personal-data flag from the primary assets they support. A file server therefore shows that it holds highly confidential information.