The CIA Triad Explained: Confidentiality, Integrity, Availability

If you learn only one model in cybersecurity, make it this one. The CIA triad is the foundation the entire field is built on, and once it clicks, every tool, control, and headline suddenly makes sense.

This guide explains the three ideas in simple terms, with everyday examples, how each one fails, and how organisations protect them. No jargon, no scare tactics.

New to security entirely? Start with What Is Cybersecurity? and come back here.

The CIA triad is a model that defines the three core goals of information security: Confidentiality, Integrity, and Availability. (No relation to the intelligence agency.)

Every security measure ever invented exists to protect one or more of these three things:

• Confidentiality — only the right people can see the data.
• Integrity — the data is accurate and hasn't been tampered with.
• Availability — the data and systems are there when you need them.

That's the whole model. Its power is that it turns a vague goal ("be secure") into three specific questions you can actually answer about any system.

Security can feel like an endless list of tools, threats, and acronyms. The triad gives you a way to organise all of it. Whenever you look at a control, a risk, or a breach, you can ask: which of the three is this protecting, or which one failed?

• A password protects confidentiality.
• A backup protects availability.
• A tamper-proof audit log protects integrity.

Every breach is ultimately a failure of one or more of these three. So the triad isn't just theory. It's the checklist professionals run in their heads, and it's the backbone of compliance frameworks like SOC 2 and ISO 27001.