CIA Triad in an ISMS Audit: What Each One Means

Confidentiality is the property that information is not made available or disclosed to unauthorised individuals, entities or processes. Integrity is the property of accuracy and completeness. Availability is the property of being accessible and usable on demand by an authorised entity. Together they are not a model of information security — they are the definition of it.

Why the CIA triad definition matters more than the mnemonic

Almost everyone in the field can recite the three words. Far fewer notice that ISO/IEC 27001 does not treat them as a framework laid on top of information security. Information security is the preservation of confidentiality, integrity and availability of information. That is the definition, not an illustration of it.

The consequence for an auditor is direct. Asked of any control, “which of the three is this protecting?” usually exposes whether anyone thought about it — and a risk or an objective that cannot be tied to any of the three is worth a second look, because it may belong to a different management system.

A note on sources, which matters unusually much on this page. Definitions are given in short form rather than reproduced, because the standards are copyright documents. And the vocabulary position has moved: the overview standard in this family used to carry the whole vocabulary and no longer does. Several definitions still widely quoted from it come from superseded editions — including one of the three below.

The three CIA triad properties, precisely

Integrity is the CIA triad property people get wrong

A correction worth making early, because a great deal of published material gets it wrong. The standard’s definition of integrity is short: the property of accuracy and completeness. It contains no wording about unauthorised modification. That longer formulation — “protecting accuracy and completeness against unauthorised modification” — is a legacy definition from a superseded edition, and it still circulates widely, including in training material. Protection from unauthorised modification is how integrity is usually preserved, not what it means.

The practical difference is real. Under the short definition, data that is simply wrong is an integrity problem — it does not matter whether an attacker changed it, a bad interface corrupted it, or a process never captured it completely in the first place. Accuracy and completeness are the property; how it is lost is a separate question.

That widens what an auditor looks at. A control environment built entirely around stopping unauthorised change protects one route to an integrity failure. A feed that silently drops records, a reconciliation nobody performs, a report built on stale data — all of those are integrity failures too, and none involves anyone doing anything unauthorised.

What to do with the legacy wording when you meet it. You will meet it, in guidance, in training material and in organisations’ own policies. It is not useless: protection from unauthorised modification is the most commonly implemented way to preserve integrity. Treat it as a description of controls rather than as the definition, and give the short definition if you are asked for one.

The three CIA triad properties pull against each other

This is the part general explainers skip, and it is where the interesting audit work is.

Confidentiality against availability. Every access restriction that protects confidentiality removes availability from someone. Encrypt a backup and lose the key, and you have perfect confidentiality and no availability at all.

Integrity against availability. Approval workflows and change control protect integrity by slowing change down. Under incident pressure they are the first things people route around, which is where an auditor should look for evidence that they held.

Confidentiality against integrity. Logging protects integrity by recording who did what. Logs are themselves sensitive, and an organisation that restricts them tightly can find nobody able to review them.

None of these tensions is a nonconformity. The requirement is that the organisation decided deliberately, on its risk assessment, and can show why. An auditor’s interest is in the decision, not the balance struck.

A fourth tension is worth naming because it is where the myth of the secure organisation comes from: all three pull against cost and usability, and every real ISMS is a set of compromises. An organisation with no compromises has either infinite money or an incomplete risk assessment.

Which CIA triad property matters most depends on the organisation

There is no universal ranking, and an auditor who arrives with one will misread the risk assessment.

A hospital’s clinical records system fails hardest on availability: a system nobody can reach during an emergency causes harm faster than one that leaks. A law firm’s document store fails hardest on confidentiality. A payments processor cannot afford an integrity failure at all, because the money moves on the record being right.

So the ranking belongs to the organisation, drawn from its context and its interested parties, and it should be visible in the risk assessment. What an auditor tests is whether it was thought about — not whether it matches the ranking the auditor would have chosen.

How the CIA triad shows up in an ISO 27001 audit

Three places, mostly.

In the risk assessment. A serious risk assessment says which property a given risk threatens. Where every risk in a register is implicitly about confidentiality, someone has copied a template rather than thought about the business — and an organisation whose real exposure is downtime has a risk process that is not looking at its own operations.

In the objectives. Clause 6.2 requires information security objectives. Objectives that only ever count phishing simulations and patch levels tell you the same thing.

In the scope and context work. Interested parties want different properties. A regulator usually cares about confidentiality; a customer with a service contract usually cares about availability. If interested-party requirements were identified but never reached the risk assessment, that is a Clause 4 finding you locate through Clause 6.

Auditing the CIA triad through ISO 27001 Annex A controls

The four Annex A themes cut across all three properties, which is why mapping controls to properties is more revealing than reading the themes in order.

Access control is usually read as a confidentiality measure, and it is. It is also an integrity measure: the reason unauthorised people cannot change a record is that they cannot reach it.

Backup and continuity controls are availability measures — and their integrity dimension is the one organisations forget. A backup that restores corrupted data has preserved availability and lost integrity. Whether a never-tested restore is a nonconformity depends on what that organisation’s own procedures and its Statement of Applicability commit it to, which is exactly the question to ask.

Logging and monitoring protect integrity and accountability, and depend on availability of the logs themselves. An organisation that logs everything and reviews nothing has bought a control it is not operating.

Supplier controls can put any of the three outside the organisation’s direct sight. Which property a supplier holds, and how the organisation assures itself of it, is a question worth asking early.

The guidance standard does some of this work for you. ISO/IEC 27002 attaches a set of attributes to each control, and one of them is literally information security properties — confidentiality, integrity, availability — alongside control type, cybersecurity concepts, operational capabilities and security domains. They are in ISO/IEC 27002 rather than in Annex A of ISO/IEC 27001, they are optional, and an organisation that has never used them is doing by hand what the guidance offers.

A quick test for any control on a Statement of Applicability: name the property it protects and the risk it treats. If nobody in the organisation can, the selection was probably copied.

Where the extra properties fit beyond the CIA triad

You will meet longer lists — authenticity, non-repudiation, reliability, accountability. Three of those four have carried formal definitions in this family’s vocabulary; accountability has not, which is itself a small illustration of how loosely the longer lists get quoted.

The definition of information security is the three, and a question asking for the definition wants the three. Older editions of the vocabulary added a note that other properties such as authenticity, accountability, non-repudiation and reliability can also be involved, so they are not outside the subject — a control designed for non-repudiation is squarely in scope of an ISMS. What is wrong is offering the longer list as the definition, which appears thorough while getting the answer wrong: exactly the habit that costs marks on a paper rewarding the supported answer over the impressive one.

Frequently asked questions about the CIA triad

Where to go next: more ISO 27001 Lead Auditor exam preparation

What an information security management system actually is

Threat, vulnerability, asset and control

Six myths that cost Lead Auditor candidates marks

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.