CIA Triad Confidentiality Integrity Availability 2026 Guide

At a glance

• The CIA triad is the three foundational goals of information security: Confidentiality, Integrity, and Availability.
• Every security control and framework ultimately serves one or more of these three goals.
• Real attacks: Equifax 2017 (confidentiality), SolarWinds 2020 (integrity), NotPetya/Maersk 2017 (availability).
• The triad is a foundation, not the whole framework; layer it with NIST, ISO 27001, or the Parkerian Hexad for formal risk management.

The CIA triad is the three-part foundation that every security professional learns first and uses throughout their career. Confidentiality, integrity, and availability are the goals that every control, policy, and framework ultimately serves. If you can map a control to one or more of the three goals, you can explain why the control matters. If you cannot, the control probably does not matter. This guide walks through each leg of the triad with real-world attacks, the controls that defend, and how the triad underpins every major security framework in 2026.

What is the CIA triad

The CIA triad is the three goals of information security, attributed to the early information security literature of the 1970s and codified in the Orange Book (DoD Trusted Computer System Evaluation Criteria, 1983). The three goals are independent but interconnected: a control that protects one goal often incidentally protects another, and an attack on one goal usually signals an attack on the others.

Confidentiality means only authorized people can read the data. Encryption, access control, and data classification are the core confidentiality controls. Integrity means the data is accurate and unaltered, both at rest and in transit. Hashing, digital signatures, and audit logs are the core integrity controls. Availability means the data is accessible when authorized users need it. Redundancy, backups, and DDoS protection are the core availability controls.

Confidentiality: what it is, what attacks it, what defends it

Confidentiality is the oldest of the three goals. The 1970s mainframe era was dominated by confidentiality: keeping classified data out of the wrong hands. Today, confidentiality covers everything from customer PII to trade secrets to internal HR data.

Real-world confidentiality attacks include the 2017 Equifax breach (147M people), the 2013 Target breach (40M card numbers), the 2017 Uber breach (57M riders and drivers), and the 2018 Marriott breach (500M guest records). The pattern is consistent: an attacker finds a gap in identity, access, or network controls, moves laterally to a high-value data store, and exfiltrates the data. The data is not altered or destroyed; it is copied. The organization still has the data; the attacker does too.