Information Security - CIA Triad and Control Types
Information security protects information per three attributes - confidentiality, integrity, availability (CIA) - using physical, administrative, and technical controls. Security differs from privacy: security protects information, while privacy decides what use/disclosure is authorized and includes the individual's right to control data.
How this supports CIPP/US study
Use this lesson to connect a privacy programme decision with the relevant regulator, duty or enforcement route. Continue with the CIPP/US study guide.
Information security preserves three key attributes - the CIA triad: confidentiality (authorized access only), integrity (authentic and complete data), and availability (accessible to the authorized as needed).
| Control type | Examples |
|---|---|
| Physical | Locks, security cameras, fences |
| Administrative | Incident response procedures, training |
| Technical | Firewalls, antivirus software, access logs |
Security differs from privacy: security protects information (personal or not) from unauthorized access; privacy decides what use/disclosure should be authorized and includes the individual's right to control data (notice and choice). Security is necessary for privacy - if security is breached, privacy controls fail. The NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover) is a voluntary strategic-planning tool.
Key terms - quick answers
What is “Confidentiality”?
What is “Integrity”?
What is “Availability”?
What is “NIST Cybersecurity Framework”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.