The CIA triad: confidentiality, integrity and availability

Confidentiality

Only authorised people can read the data. Threats: eavesdropping, stolen passwords, data breaches. Controls: encryption, access control and permissions, strong authentication (passwords plus multi-factor), physical security.

Integrity

Data is accurate and complete and has not been altered without authorisation, whether by attackers or by accident. Threats: tampering, transmission errors, malware. Controls: hashing and digital signatures, checksums and parity, access controls, version control, audit logs, backups.

Availability

Authorised users can access systems and data when they need them. Threats: denial of service (DoS/DDoS) attacks, hardware failure, ransomware, power cuts, natural disasters. Controls: redundancy (spare servers, RAID), backups and disaster recovery plans, DDoS protection, maintenance and patching, uninterruptible power supplies.

Why all three matter and how they conflict

A system is only secure if all three are protected. They can pull against each other: very strict access controls protect confidentiality but can reduce availability; keeping many copies helps availability but gives more places to steal data. Security design is about the right balance for the data's value.

Worked example

A hospital's records system is hit by ransomware that encrypts patient files and threatens to publish them. Which parts of the CIA triad are attacked?

1. Encrypting the files stops doctors using them: availability.
2. Threatening to publish them: confidentiality.
3. If records were changed during the attack, integrity too.

Answer: Availability and confidentiality (and possibly integrity).

Check yourself

1. Encrypting a laptop's hard disk mainly protects which part of the CIA triad?
   • Availability
   • Integrity
   • Accountability
   • Confidentiality
   Show answer

   Confidentiality. Encryption stops unauthorised people reading the data.

2. A hash value is checked to show a downloaded file has not been changed. Which part of the triad does this protect?
   • Confidentiality
   • Integrity
   • Availability
   • Authentication only
   Show answer

   Integrity. Integrity means the data is unaltered.

3. A DDoS attack floods a website so customers cannot reach it. Which part of the triad is attacked?
   • Confidentiality
   • Integrity
   • Non-repudiation
   • Availability
   Show answer

   Availability. Users cannot access the service when needed.

4. Which control mainly supports availability?
   • Keeping redundant servers and tested backups
   • Encrypting emails
   • Hashing passwords
   • Digitally signing documents
   Show answer

   Keeping redundant servers and tested backups. Redundancy and backups keep services running.

5. A diagram of the CIA triad is labelled Confidentiality and Integrity. What is the missing label?
   • Authentication
   • Authorisation
   • Availability
   • Accuracy
   Show answer

   Availability. C, I and A: availability.

6. Why can strengthening confidentiality reduce availability?
   • Tighter access controls can make it harder for legitimate users to reach the data
   • Encryption deletes data
   • Availability only applies to public data
   • Confidentiality removes backups
   Show answer

   Tighter access controls can make it harder for legitimate users to reach the data. Every extra barrier can also slow down authorised users.

Practise with instant feedback Print this lesson

Sources

• Pearson Edexcel International Advanced Subsidiary and Advanced Level in Computer Science specification (2026), Issue 1
• Pearson Edexcel IAL Computer Science sample assessment materials (Unit 3 paper, resource booklet and mark scheme)

Last updated 8 November 2026. Spotted a mistake? Tell us.