Confidentiality, integrity, and availability, often called the CIA triad, are the three core security goals used to evaluate risk in a system. Confidentiality means data is kept secret from unauthorized people. Integrity means data remains accurate, complete, and unmodified except by approved actions. Availability means authorized users can access systems and data when needed.
This model matters because security controls usually protect one or more of these goals. Encryption and access control support confidentiality, checksums and logging help protect integrity, and redundancy plus patching improve availability. In real attacks, ransomware can destroy availability, database tampering can break integrity, and data leaks violate confidentiality. In defenses, teams use the triad to decide what to prioritize: a management console exposed to attackers may threaten all three, especially if it can reveal sensitive information, alter configuration data, or disrupt service. The triad gives defenders a simple way to measure business impact and choose the right response.