CIA triad

The triad has no single inventor. Saltzer and Schroeder's 1975 paper "The Protection of Information in Computer Systems" grouped security violations into unauthorised release of information, unauthorised modification and unauthorised denial of use, which map onto confidentiality, integrity and availability. The three words became fixed in US government doctrine and later in the Federal Information Security Management Act, whose definitions FIPS 199 reuses. ISO/IEC 27000 defines information security as the preservation of confidentiality, integrity and availability, and notes that other properties such as authenticity, accountability, non-repudiation and reliability can also be involved. NIS2 Art. 6(2) lists availability, authenticity, integrity and confidentiality, effectively a four-property model.

Each leg has its own classical formal model. Bell-LaPadula (1973) formalises confidentiality with "no read up, no write down"; Biba (1977) inverts the rules for integrity; Clark-Wilson (1987) models commercial integrity with well-formed transactions and separation of duties. Availability has no comparable lattice model and is usually handled with reliability engineering, capacity planning and continuity planning rather than access rules. That asymmetry is one reason availability was long treated as an operations problem rather than a security one, until ransomware and DDoS made it central.

The main practical use is categorisation. FIPS 199 rates the potential impact of a loss of each property separately as low, moderate or high, giving a security category such as {(confidentiality, moderate), (integrity, high), (availability, low)}; FIPS 200 then applies the high-water mark to select an SP 800-53 baseline. ISO/IEC 27002:2022 tags each of its 93 controls with the properties it protects (#Confidentiality, #Integrity, #Availability), and many risk methods score consequence per property, so that a public website can be low on confidentiality yet high on integrity and availability.

The model has known limits. Donn Parker's hexad (1998) added possession or control, authenticity and utility, arguing, for example, that a stolen but still encrypted laptop is a loss of possession without a loss of confidentiality. The properties also conflict: more copies improve availability but widen the confidentiality exposure, and strict integrity checks can block service. The triad describes goals, not controls or threats, and says nothing about privacy in the GDPR sense, safety in operational technology, where availability and integrity usually dominate, or accountability. It works best as a checklist of questions per asset rather than as a complete theory of security.