Study Guide
CIA Triad
Apply confidentiality, integrity and availability to a fictional booking service, with controls and their limitations.
Lesson 1.2 Cybersecurity Foundations
This lesson sets out the three objectives that security professionals use to say what they are protecting. Almost every later lesson refers back to them, so they are worth learning precisely. It starts from something you already care about.
Stage: Think
What could go wrong with your exam results?
A school keeps every pupil’s exam results in an online system. Teachers enter the grades, and on results day pupils and their parents sign in to see them. Think about the record of your own results.
Think it through
List the things that could go wrong with the record of your exam results. Try to find three quite different kinds of problem.
- Hint 1: Who should be able to look at your results, and who should not?
- Hint 2: What if the grade on the screen were not the grade you earned?
- Hint 3: What if, on results day, nobody could open the system at all?
Show what happens
Most answers fall into three groups.
- The wrong people see it. Another pupil, or a stranger, looks at your grades.
- It is wrong. A grade is typed incorrectly, or someone changes it.
- You cannot get at it. On results day the system will not load.
These are three different things you need from the record, and each can fail on its own. A record that only you can see is no use if the grade in it is wrong. A correct record is no use if nobody can open it on results day.
When something goes wrong with information, the first useful question is what went wrong with it. Was it seen by the wrong people, was it changed, or could nobody use it? The answer decides who needs to respond, which safeguards matter and what to report, and it stops anyone claiming more harm, or less, than the evidence shows.
Stage: Predict
One record, three questions
Your exam results are not a special case: the same three things matter for any important information. Think of something you would not want strangers to see: a bank statement, private messages, a medical record. Keeping it private is the first of the three. It is not enough on its own, as the next question shows.
Think it through
Show the answer
Answer: B. No: it is private, but the dose in it can no longer be trusted.
The record is still confidential: no stranger has read it. But its integrity has been compromised: the dose written in it is wrong, so a doctor who trusts it could harm the patient. Keeping information private does nothing to keep it correct. These are two separate protections, confidentiality and integrity, and one can fail while the other holds.
Ask all three questions of a medical record.
| The question | For the medical record |
|---|---|
| Who may see it? | Strangers should not be able to read it. |
| Can it be trusted? | A diagnosis or a medication should not be changed without authorisation. |
| Can it be used when needed? | Authorised medical staff need access to it when it is required. |
Each row can fail while the other two hold. A record that no stranger can read is no help if the dose written in it has been altered. An accurate, private record is no help to a doctor who cannot open it during an emergency.
Stage: Explain
The idea
The three questions have names. Together, confidentiality, integrity and availability are called the CIA triad: a triad is a group of three, and CIA is their initials. Here they are stated formally. “Authorised” means allowed, by whoever is responsible for the information.
- Confidentiality: information is accessible only to authorised people, systems or processes.
- Integrity: information remains accurate, complete and protected against unauthorised or improper modification.
- Availability: information and services remain accessible to authorised users when needed.
The record sits in the middle. Each objective asks its own question about it, says what it needs, and shows what failure looks like. The three are separate: any one can fail while the other two hold.
The information
Your exam-results record
- Grades entered by teachers
- Sign-in for pupils and parents
- Results day
CIA triad
Confidentiality
Who may see it?
Only these people:
- You and your parents
- Your teachers and the exams office
If it fails: another pupil, or a stranger, reads your grades.
CIA triad
Integrity
Can it be trusted?
It must stay:
- Accurate: the grade you earned
- Changed only by authorised staff, for a proper reason
If it fails: a grade is mistyped or altered, so the record no longer shows what you earned.
CIA triad
Availability
Can it be used when needed?
It must work:
- On results day, when everyone signs in at once
- For staff who need to check or correct it
If it fails: on results day the system will not load.
The school and its system are fictional. The three failures are the three groups from the opening question.
CIA is a set of objectives, not an attack sequence. They apply together, but a particular incident may affect one, two or all three. A service being online does not establish that its records are accurate or private. Equally, keeping information secret is insufficient if authorised staff cannot use it when required.
Check your understanding
Show the answer
Answer: C. Availability: customers cannot use it when they need to.
Ask the three questions separately: nobody sees what they should not (confidentiality holds), the prices are right (integrity holds), and the service cannot be used when needed (availability fails).
Stage: Experiment
Putting it into context
Imagine a fictional sports centre with an online booking service. The service holds customers’ names and contact details, their booking dates and a record of what they have paid. Customers manage their own bookings, and staff use the same records to get each day ready.
Three things go wrong, one after another. Each case asks the same four questions: what happened, which objective failed, what would have helped, and what a familiar control could not have done. Before each answer, make your own prediction.
Confidentiality: who may see the information?
What happens. Priya signs in to check her badminton booking. The address of the page ends in her booking number, 1042. Out of curiosity she changes it to 1043, and the service shows her another customer’s name, phone number and booking.
Think it through
Show the answer
Answer: B. No: the service itself sent the record to Priya over that connection.
The encryption did its own job: nobody could read the traffic on the way. But the service chose to send another customer’s record to Priya, and encryption cannot correct that choice.
Which objective failed. Confidentiality: someone saw information they were not authorised to see. Every booking is still accurate and the service kept working, so nothing looked wrong. The absence of visible disruption does not make the disclosure harmless.
What would have helped. Two separate checks are needed, and the service made only the first.
- Authentication: proving who is signing in. Priya’s password did that.
- Authorisation: checking that this person is allowed to see this record. The service never asked whether booking 1043 was Priya’s. A valid sign-in is not permission to read every booking.
The same applies to staff. Access should match what each person’s job needs, which is the subject of least privilege.
What a familiar control could not have done. Encryption scrambles information so that only someone holding the right key can read it. The connection between Priya and the service was encrypted the whole time, and it made no difference: encryption does not correct an application that willingly hands the wrong record to a signed-in user. An encrypted connection to the wrong recipient is still a disclosure.
Integrity: can users rely on the record?
What happens. A booking for a children’s party on Saturday the 14th is changed to Sunday the 15th. Nobody asked for the change. Staff set up the hall on the wrong day, and the family arrive on Saturday to a locked room.
Think it through
Show the answer
Answer: B. No: Sunday the 15th is a valid date, so the rule accepts it.
A check on whether input makes sense is not a check on whether the person was permitted to make the change.
Which objective failed. Integrity: the record is no longer accurate. It is an integrity failure even though nobody outside the centre saw the booking, and it would be one whether the change was made by an attacker or by a member of staff clicking on the wrong row.
What would have helped.
- Restricting who can create, edit and cancel bookings, with a defined route for changes: for example, a date changes only when the customer has asked for it.
- An audit trail: an automatic record of who changed what, and when. It would show which account made the change and at what time. Comparing it with the customer’s original request shows what the record should say, so it can be put right.
What a familiar control could not have done. Validation means the service checking that what is typed makes sense, such as refusing 31 February. It would not have helped here, because Sunday the 15th is a perfectly valid date. A rule that accepts valid input is not a check that the person was permitted to make the change. An audit trail has limits too: it records a change, but it does not prove the change was justified, and it does not undo the wasted Saturday.
Integrity is not a ban on all change. A customer’s properly authorised correction keeps the record accurate. Accidental errors damage integrity as well, so the objective is wider than catching malicious edits.
Availability: can authorised people use the service?
What happens. On Monday morning, customers trying to book see an error page. Every booking record is intact. The fault is somewhere else: the separate sign-in system that the booking service relies on has stopped, so nobody can log in.
Think it through
Show the answer
Answer: C. No: nothing was lost; the sign-in system it depends on stopped.
A backup protects against losing data. This failure lost no data at all: a different system the booking service depends on stopped working.
Which objective failed. Availability: authorised people cannot use the service when they need it. Availability is about the usable service, not only whether the files still exist.
What would have helped.
- Knowing the service’s dependencies: the other things it needs in order to work, such as the sign-in system, the network and the database that stores the bookings.
- Monitoring each of them, so that staff find out before customers do.
- A recovery plan that covers each dependency. Restoring one part may not restore the whole service.
How quickly the service must come back depends on the organisation. An hour’s outage is an irritation for a sports centre and far more serious for a hospital.
What a familiar control could not have done. A backup is a spare copy of the data. It would not have helped here, because no data was lost. Even when data is lost, a successful backup shows only that a copy exists. It does not show how long it takes to bring the service back, which is known only once a restoration has been practised.
Stage: Explain
Controls to consider
The three sports-centre cases each named a control and its limit. The table collects them. Choose controls for the actual information, users and risks: one control may support several objectives, and one objective may need several controls.
Comparison table: scroll horizontally on narrow screens.
| Objective | Control contribution | Important limitation |
|---|---|---|
| Confidentiality | Authentication, record-level access restrictions and appropriate encryption protect private booking information. | Encryption does not authorise recipients or stop a compromised account from using permissions it already has. |
| Integrity | Restricted editing, validation, protected change records and checks against authorised requests reduce or reveal improper changes. | A valid format or recorded edit does not establish that the change was authorised or correct. |
| Availability | Capacity, resilience, monitoring, backups and recovery arrangements support usable service and restoration. | A backup alone does not keep a service online, prove recovery performance or undo an earlier disclosure. |
These limitations do not make the controls ineffective; they identify what each control contributes and what other safeguards must address. For example, encryption can support confidentiality while the encrypted service is still unavailable because its network connection has failed. A recoverable copy may help restore a correct booking record, but restoring it does not retrieve copies already stolen by an attacker.
Defence in Depth explains how controls that prevent, detect, respond and recover work together.
A member of staff at the fictional booking service emails a spreadsheet of customer bookings to the wrong external address. Work through each objective separately.
- State the facts. An unauthorised person received the file. Nothing indicates that the booking records themselves changed, and the booking service kept working.
- Confidentiality: affected. Someone who is not authorised can now read customer details.
- Integrity: not established. The records in the booking system are still accurate as far as the evidence shows. Record it as not affected unless evidence appears.
- Availability: not affected. Customers and staff can still use the service.
- Match the response to the affected objective. Restoring from a backup would not help, because nothing was lost or damaged: restoration does not undo disclosure. Useful controls here include checking recipients before sending and restricting who can export customer lists.
- Consider wider obligations. Customer details are personal data, so the organisation would also need to assess its data-protection obligations. Data Protection: UK GDPR and the DPA 2018 explains that assessment.
A mistake, not an attacker, caused this incident. CIA objectives can be affected by accidents as well as deliberate attacks.
CIA gives you a precise way to describe a problem. “Customers can see each other’s bookings” is a confidentiality problem; “booking dates have changed and nobody knows why” is an integrity problem; “the booking site will not load” is an availability problem. Naming the affected objective helps decide who needs to respond and which controls are relevant, and it avoids recording impacts that the evidence does not show.
Stage: Check
Classifying an impact
A common task, in real incidents and in revision questions, is to read a short description of something going wrong and say which objective is affected. Three test questions do the work.
- Did someone see or obtain information they were not authorised to have? That is confidentiality.
- Is the information now wrong, altered or incomplete, without authorisation? That is integrity.
- Are authorised people unable to use the system or the information when they need it? That is availability.
Ask all three, every time. One event can produce more than one “yes”, and the description usually contains a clue for each.
| What happened | Objective affected | The clue |
|---|---|---|
| A stranger reads a patient’s medical record. | Confidentiality | Someone saw information they should not have seen. |
| A medication dose in the record is changed without authorisation. | Integrity | The information is no longer accurate. |
| Staff cannot open the record when they need it. | Availability | Authorised people cannot use it. |
| An outsider copies a water-treatment plant’s diagrams and administrator credentials. | Confidentiality | Information was obtained. Nothing was changed. |
| A sensor at the plant reports a false reading, or a chemical-dosing setting is altered. | Integrity | What the operators see, or what the plant does, can no longer be trusted. |
| The plant’s monitoring and control systems stop responding. | Availability | Operators cannot watch or control the process. |
The last three rows use a water-treatment plant, where an integrity failure could cause physical harm and not only a data problem.
Classify by what happened to the information or the system, not by who caused it or how. An accident counts in exactly the same way as an attack.
Check your understanding
Show the answer
Answer: A. Confidentiality, because people who should not see it can read it.
Apply the three tests in turn: someone unauthorised now has the report (confidentiality: yes); the records are unchanged (integrity: no); the system works (availability: no).
Check your understanding
Show the answer
Answer: A. Integrity, because the record no longer shows what really happened.
The method (a borrowed password) does not decide the objective; the effect on the record does. The record is now wrong, which is integrity. The misuse of the password is a problem in its own right, and it is the subject of later lessons on access control.
Three pairs that are easy to confuse
- Confidentiality and integrity. Reading is not changing. If the description says information was viewed, copied, leaked or sent to the wrong person, that is confidentiality. If it says something was altered, falsified or tampered with, that is integrity. The fact that someone could read a record does not show that it was changed.
- Integrity and availability. If the information is there but wrong, that is integrity. If it is right but cannot be reached, that is availability. A booking site that is offline is an availability problem even when every record behind it is accurate.
- Availability and confidentiality. A system that has been switched off discloses nothing and is also completely unavailable. Protecting one objective by giving up another is not security, which is why all three questions are asked together.
Check your understanding
Show the answer
Answer: C. Disagree: the evidence shows a confidentiality failure; integrity is not established.
Classify by what the evidence shows. The results were read, which is confidentiality. Checking them for changes is a sensible next step; only evidence of a change would make it an integrity failure as well.
Stage: Discover
One incident can affect several objectives
Think it through
Show the answer
Answer: B. No: theft shows confidentiality failed; a change needs its own evidence.
One incident can affect one, two or all three objectives. Establish each one from the evidence rather than assuming it from the incident’s label.
The DAD document-service scenario follows unauthorised reading, alteration and disruption within one fictional incident. It illustrates multiple consequences, not an assertion that disclosure must always lead to modification or unavailability.
In the Attack Chain, data exfiltration may cause disclosure. Ransomware can deny access and affect integrity; incidents involving theft can also affect confidentiality. Establish what happened to each objective rather than assuming the incident label proves every possible consequence.
Stage: Explain
Beyond the triad
Confidentiality, integrity and availability are the three members of the triad, and there are exactly three. Security work also relies on a further property, non-repudiation: evidence of who performed an action, strong enough that they cannot credibly deny it. It is often taught alongside the triad, but it is not part of it.
Check your understanding
Show the answer
Answer: A. Non-repudiation, which is related to the triad but not part of it.
The property that stops someone credibly denying an action is non-repudiation. It relies on integrity, because the evidence must not be altered, but it is a separate property and not one of the three.
Non-Repudiation explains that property, separates it from integrity and applies all four properties to the water-treatment plant.
Stage: Apply
Apply it in a new situation
These questions use the triad in situations the lesson has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Go through the three test questions one by one.
Show the answer
Answer: B. Integrity, because the times in the records are now wrong.
The appointment times are no longer accurate, which is integrity. The cause was an accident, which makes no difference to the classification. Missed appointments are a consequence of the integrity failure; the system itself remained available.
Apply it
- Hint 1: Match each objective to the controls the lesson linked it with.
Show the answer
Answer: C. Disagree: it supports confidentiality, not correct records or a working service.
Encryption mainly supports confidentiality. It does not stop an authorised user making an improper change, and it does not keep the service running: those need controls such as restricted editing, audit trails, monitoring and recovery plans.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Confidentiality
Confidentiality concerns authorised access; integrity concerns unauthorised changes, and availability concerns access when required. Non-repudiation is not one of the three CIA objectives.
Revision sources: Session 2: Cyber Fundamentals Part 2 (Classroom session record)
Show answer
Answer: Integrity
An unauthorised modification directly affects integrity. The scenario does not describe disclosure or loss of access. Non-repudiation is not one of the three CIA objectives.
Revision sources: Session 2: Cyber Fundamentals Part 2 (Classroom session record)
Show answer
Answer: Confidentiality has failed through inappropriate record access despite encrypted transport.
Encryption protects the connection, not the correctness of record-level authorisation. Unauthorised reading establishes disclosure without proving alteration or outage.
Revision sources: CIA Triad (Supplementary Study Guide explanation)
Show answer
Answer: Restrict editing permissions to authorised roles.; Compare protected change records with approved requests.
Editing restrictions and review against authorised changes support integrity. Valid formatting and encrypted transport alone cannot establish permission or correctness.
Revision sources: CIA Triad (Supplementary Study Guide explanation)
Show answer
Answer: Confidentiality, because someone without authorisation saw the information
Confidentiality means that only authorised people or systems can access information. The visitor was not authorised and read the diagnosis, so confidentiality is affected. Protecting privacy is a confidentiality matter, not an integrity one: integrity would need the information to be wrong, altered or incomplete, and the description says that nothing was altered. Being able to read a record does not show that it was changed. Disclosure counts even though nothing was taken or altered.
Revision sources: CIA Triad (Supplementary Study Guide explanation)
Show answer
Answer: Integrity, because the information is no longer accurate
Integrity means information remaining accurate, complete and protected from unauthorised modification. An unauthorised change to a dose makes the record inaccurate, so integrity is affected. Information that is present but wrong is an integrity matter, while availability concerns whether authorised people can reach it at all, and here they can. Confidentiality is not shown to be affected: the description says that nobody outside the care team has seen the record, and a change does not by itself show a disclosure.
Revision sources: CIA Triad (Supplementary Study Guide explanation)
Show answer
Answer: Availability
In a water-treatment environment, the monitoring and control systems fall under availability, which means authorised users being able to access systems and data when required, and operators who cannot see readings or adjust the process have lost exactly that. The description says that nothing was altered, so integrity is not shown to be affected, and that nothing was disclosed, so confidentiality is not either. Each objective is judged from what the description says actually happened.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · CIA Triad (Supplementary Study Guide explanation)
Show answer
Answer: Integrity, because the readings can no longer be trusted
In a water-treatment environment, sensor readings and control settings fall under integrity, where altered dosing or falsified readings could cause physical harm; integrity means information remaining accurate and protected from unauthorised modification. A reading that looks safe but is false is an integrity failure, and a dangerous one, because nothing appears to be wrong. The screens still work, so availability is not the issue, and nothing has been disclosed to anyone unauthorised, so confidentiality is not either.
Revision sources: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles (Classroom session record) · CIA Triad (Supplementary Study Guide explanation)
Show answer
Answer: False
False. Reading is not changing. Unauthorised reading is a confidentiality failure. An integrity failure needs the information to be wrong, altered or incomplete without authorisation, and being able to read a record does not show that it was changed. The two objectives are judged separately, so an event is recorded against integrity only when there is evidence that the information itself was affected.
Revision sources: CIA Triad (Supplementary Study Guide explanation)
Show answer
Answer: Confidentiality; Availability
One event can affect more than one objective, so each test question is asked separately. Copying the customer list means someone obtained information without authorisation, which is confidentiality. Staff being unable to open the database when they need it is availability. The description says the records were not altered, so integrity is not shown to be affected. Naming only the objectives that the evidence supports avoids recording an impact that did not happen.
Revision sources: CIA Triad (Supplementary Study Guide explanation)
Practise selected concepts through the topic overview, quiz and flashcards. Most of this revision is learning-only and is reached through the All topics track. The questions that have been verified against CompTIA Security+ SY0-701 objective 1.2 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and fictional scenarios are not practical evidence.
Stage: Consolidate
What to remember
- Confidentiality: only authorised people, systems or processes can see the information.
- Integrity: the information is accurate and complete, and changes only with authorisation. Accidents count.
- Availability: authorised people can use the information and the service when they need them.
- Ask all three questions, every time, and record what the evidence shows for each.
- Every control has limits. Encryption does not authorise a recipient, validation does not authorise a change, and a backup does not keep a service running.
- Non-repudiation is a related property, not a fourth member of the triad.
Common misunderstandings
Encryption protects information in transit or storage, but it does not stop an application from returning another customer’s details to a logged-in user.
Availability says nothing about whether records are accurate or private. Check each objective separately.
Authorised corrections preserve accuracy. Integrity is about preventing unauthorised or improper change, including accidental errors.
A backup can support recovery, but it does not keep a service online, prove how quickly it can be restored or undo a disclosure.
Further reading
The glossary of the US National Institute of Standards and Technology (NIST) defines confidentiality, integrity and availability.
Lesson sources and acknowledgements
Sources and scope
The approved Session 2 Learning Log records these objectives and the discussion of encryption as one way to support confidentiality. The worked booking scenario in this lesson develops the supplied Session 2A educational reference. The sports centre, its booking service and the three things that go wrong are fictional: they are not a classroom exercise, an incident or a system I built or tested, and no restoration was timed. The approved Session 2 log establishes classroom scope; the supplied Session 2A reference supports the supplementary explanations. The exam-results diagram, the misdirected-email example and the misunderstandings are supplementary explanations.
Session 7 introduced the triad again, through the question of what you would not want strangers to see, and applied it to a water-treatment plant. The opening question and the water-treatment setting come from that session; the items mapped to each objective in the classification table are supplementary. The medical-record example was developed afterwards as a supplementary example. The three test questions, the rest of the classification table, the pairs that are easy to confuse and the note that non-repudiation is not part of the triad are supplementary explanations.
This guided version (published 1 November 2026, awaiting the site owner’s editorial review) adds supplementary material written for the Study Guide: the exam-results opening and its diagram, the school, shop, surgery and finance examples, every question asked in the lesson with its feedback and hints, and the closing summary. All of these settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
An unauthorised or improper change to information or systems. Alteration threatens integrity.
A record of which account did what and when on a system, such as sign-ins, changes and approvals.
Establishing or verifying a claimed identity, for example when a user signs in.
The security objective of keeping systems, services and information accessible to authorised users when required.
Three fundamental information security objectives: confidentiality, integrity and availability.
The security objective of restricting information to authorised people, systems or processes.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
The unauthorised transfer of information out of an environment.
Information becoming accessible to an unauthorised party. Disclosure threatens confidentiality, even if the original information is unchanged.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
How serious the consequences of an event would be for the organisation and the people affected.
The security objective of keeping information accurate and complete by protecting it from unauthorised or improper modification.
Evidence that an action or communication took place and of who performed it, strong enough that the person cannot credibly deny it.
Information relating to an identified or identifiable living individual.
Malicious software that denies access to systems or data, typically by encrypting them, in order to extort payment. Some incidents also involve data theft.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.