Skip to content
LevelUp101.net

The Seven Elements of Information Security: The CIA Triad and Four Additional Properties

Section titled “The Seven Elements of Information Security: The CIA Triad and Four Additional Properties”

The foundation of information security is commonly expressed through the CIA triad:

  • Confidentiality
  • Integrity
  • Availability

The acronym CIA comes from the first letter of each term.

When information security is considered more broadly, four additional properties are also useful:

  • Authenticity
  • Accountability
  • Non-repudiation
  • Reliability

These three core elements plus the four additional properties are often described in Japan as the seven elements of information security.

A useful standards-related distinction is important, however. ISO/JIS terminology treats the preservation of confidentiality, integrity, and availability as the core of information security and notes that other properties such as authenticity, accountability, non-repudiation, and reliability can also be involved.

A practical way to remember the model is:

Use CIA to protect information at the fundamental level, then use the additional four properties to verify identity and origin, trace actions, preserve evidence, and ensure dependable operation.

Overview of the Seven Elements

Section titled “Overview of the Seven Elements”
Category Element Key question
CIA Confidentiality Can unauthorized people access the information?
CIA Integrity Can the information be altered or destroyed improperly?
CIA Availability Can authorized users access the information or service when needed?
Additional Authenticity Can we verify that a person, system, or piece of data is genuine?
Additional Accountability Can we determine who performed an action and when?
Additional Non-repudiation Can we prove an action or transaction so that it cannot later be improperly denied?
Additional Reliability Does the system operate correctly and consistently as intended?

What Is the CIA Triad?

Section titled “What Is the CIA Triad?”

The CIA triad is one of the most fundamental models in information security.

Security is not only about preventing data leaks. At a minimum, an organization should consider three questions:

  1. Confidentiality — Can we prevent unauthorized disclosure?
  2. Integrity — Can we prevent unauthorized or accidental modification?
  3. Availability — Can authorized users use the system when they need it?

The three objectives must also be balanced. For example, extremely restrictive access controls can improve confidentiality while making a service unnecessarily difficult to use or operate.

1. Confidentiality

Section titled “1. Confidentiality”

What Is Confidentiality?

Section titled “What Is Confidentiality?”

Confidentiality means ensuring that information is available only to authorized people, organizations, or systems.

Personal data, customer records, credentials, contracts, source code, trade secrets, and internal documents must be protected from unauthorized disclosure.

Typical Risks

Section titled “Typical Risks”
  • Account takeover
  • Excessive permissions
  • Misconfigured cloud storage
  • Email sent to the wrong recipient
  • Lost laptops or mobile devices
  • Malware stealing data
  • Insider data theft

Practical Controls

Section titled “Practical Controls”

Strengthen Authentication

Section titled “Strengthen Authentication”
  • Require multi-factor authentication (MFA)
  • Use phishing-resistant authentication such as passkeys where appropriate
  • Avoid shared user accounts
  • Disable unnecessary accounts promptly after role changes or termination
  • Separate privileged administrator accounts from normal user accounts

Enforce Access Control

Section titled “Enforce Access Control”
  • Apply the principle of least privilege
  • Use role-based access control (RBAC)
  • Review permissions periodically
  • Restrict sensitive data to users with a legitimate business need

Encrypt Data

Section titled “Encrypt Data”
  • Use HTTPS/TLS for data in transit
  • Encrypt databases, object storage, and backups
  • Enable full-disk encryption on endpoints
  • Do not embed secrets or encryption keys directly in source code
  • Use secure key and secret management services

Control Information Handling

Section titled “Control Information Handling”
  • Classify information, for example as Public, Internal, Confidential, or Restricted
  • Use Data Loss Prevention (DLP) where appropriate
  • Restrict removable media
  • Define rules for external sharing and email attachments

Protect Physical Access

Section titled “Protect Physical Access”
  • Control access to offices and server rooms
  • Lock screens when devices are unattended
  • Support remote lock or remote wipe for managed devices
  • Securely store and dispose of paper documents containing sensitive information

2. Integrity

Section titled “2. Integrity”

What Is Integrity?

Section titled “What Is Integrity?”

Integrity means maintaining the accuracy and completeness of information and protecting it against unauthorized or unintended modification, deletion, or destruction.

A system is not secure if transaction amounts, configuration files, contracts, or business records can be altered without authorization—even if no data is leaked.

Typical Risks

Section titled “Typical Risks”
  • Website defacement
  • Unauthorized database changes
  • Malware modifying files
  • Accidental deletion or corruption
  • Unauthorized configuration changes
  • Data modification in transit

Practical Controls

Section titled “Practical Controls”

Restrict Write Access

Section titled “Restrict Write Access”
  • Limit modification privileges to authorized users and systems
  • Restrict direct changes to production systems
  • Monitor privileged activity
  • Use segregation of duties for important business processes

Detect Tampering

Section titled “Detect Tampering”
  • Use cryptographic hashes or checksums
  • Use digital signatures
  • Monitor critical files and websites for unexpected changes
  • Record before-and-after values for sensitive changes where appropriate

Protect Database Consistency

Section titled “Protect Database Consistency”
  • Use primary keys, foreign keys, UNIQUE constraints, and other database controls
  • Use transactions correctly
  • Validate input
  • Enforce important rules at the database layer rather than relying only on application logic

Manage Changes

Section titled “Manage Changes”
  • Use version control systems such as Git
  • Require peer review and pull requests
  • Establish approval processes for production changes
  • Use Infrastructure as Code (IaC)
  • Automate tests and security checks in CI/CD pipelines

Make Recovery Possible

Section titled “Make Recovery Possible”
  • Maintain backups
  • Use versioning
  • Regularly test restoration
  • Protect critical backups against modification or deletion, including ransomware scenarios

3. Availability

Section titled “3. Availability”

What Is Availability?

Section titled “What Is Availability?”

Availability means ensuring that authorized users can access information and services when needed.

Information security is not only about preventing unauthorized access. A secure system must also remain usable and recoverable during failures, attacks, or disasters.

Typical Risks

Section titled “Typical Risks”
  • Server failure
  • Network outages
  • Cloud service outages
  • Distributed Denial-of-Service (DDoS) attacks
  • Ransomware
  • Power failure
  • Natural disasters
  • Capacity exhaustion
  • Operational mistakes

Practical Controls

Section titled “Practical Controls”

Reduce Single Points of Failure

Section titled “Reduce Single Points of Failure”
  • Use redundant servers and network components
  • Use load balancers
  • Distribute workloads across multiple availability zones or failure domains
  • Review DNS and network path resilience

Detect Problems Quickly

Section titled “Detect Problems Quickly”
  • Monitor CPU, memory, disks, and networks
  • Use application health checks
  • Monitor error rates and latency
  • Analyze logs and metrics
  • Alert responsible personnel when failures occur

Prepare Backup and Disaster Recovery

Section titled “Prepare Backup and Disaster Recovery”
  • Take regular backups
  • Document restoration procedures
  • Test recovery regularly
  • Define Recovery Time Objectives (RTOs)
  • Define Recovery Point Objectives (RPOs)
  • Maintain Business Continuity and Disaster Recovery plans

Prepare for Attacks and Load Spikes

Section titled “Prepare for Attacks and Load Spikes”
  • Implement DDoS protection
  • Use a Web Application Firewall (WAF)
  • Use autoscaling where appropriate
  • Apply rate limiting
  • Monitor capacity trends

Maintain Supportability

Section titled “Maintain Supportability”
  • Apply security and stability patches
  • Replace end-of-life products
  • Maintain incident and recovery procedures
  • Avoid dependence on a single individual who alone knows how to restore the service

What Are the Four Additional Properties?

Section titled “What Are the Four Additional Properties?”

The CIA triad covers the foundation of information security, but real systems also need answers to questions such as:

  • Is this user really who they claim to be?
  • Is this system or message genuine?
  • Who performed this operation?
  • Can the organization prove that the action occurred?
  • Does the system behave correctly and consistently?

Authenticity, Accountability, Non-repudiation, and Reliability help address these questions.

4. Authenticity

Section titled “4. Authenticity”

What Is Authenticity?

Section titled “What Is Authenticity?”

Authenticity is the property of being able to verify that a person, organization, system, communication peer, or piece of data is genuine and is what it claims to be.

Correct credentials alone do not always prove that the legitimate user is present. Stolen credentials can be used for impersonation, so stronger controls may be required.

Practical Controls

Section titled “Practical Controls”
  • Require MFA
  • Use passkeys
  • Use biometric authentication where appropriate
  • Use client certificates or mutual TLS (mTLS)
  • Validate server certificates correctly
  • Use Public Key Infrastructure (PKI)
  • Use digital signatures to verify documents or software publishers
  • Use code signing
  • Use SPF, DKIM, and DMARC to reduce email sender spoofing
  • Verify identity when creating sensitive accounts
  • Authenticate service-to-service and API communications

Example

Section titled “Example”

An online banking service that verifies a customer using a passkey or strong MFA improves the authenticity of the login process.

5. Accountability

Section titled “5. Accountability”

What Is Accountability?

Section titled “What Is Accountability?”

Accountability is the ability to trace actions to the person, account, process, or system responsible for them.

If an incident occurs but the organization cannot determine what happened, who performed the action, or when it occurred, investigation and prevention become extremely difficult.

Practical Controls

Section titled “Practical Controls”

Tie Actions to Identifiable Identities

Section titled “Tie Actions to Identifiable Identities”
  • Avoid shared IDs
  • Assign unique identities to individual users
  • Ensure administrator activity can be attributed to a person
  • Use Privileged Access Management (PAM)
  • Record the real operator when administrators act on behalf of other users

Record Audit Events

Section titled “Record Audit Events”

Consider logging:

  • Login and logout events
  • Authentication failures
  • Data access
  • Data creation, modification, and deletion
  • Permission changes
  • Administrative actions
  • Configuration changes
  • API calls
  • Critical business transactions

Protect the Logs

Section titled “Protect the Logs”
  • Centralize audit logs
  • Use a SIEM or other searchable analysis platform
  • Define log retention periods
  • Restrict access to audit logs
  • Store important logs in tamper-resistant or immutable storage
  • Synchronize system clocks using NTP or an equivalent trusted time source

Review and Investigate

Section titled “Review and Investigate”
  • Review privileged activity regularly
  • Detect suspicious logins or abnormal data downloads
  • Ensure investigators can correlate events across multiple systems

6. Non-repudiation

Section titled “6. Non-repudiation”

What Is Non-repudiation?

Section titled “What Is Non-repudiation?”

Non-repudiation provides evidence that an action, transaction, approval, or communication occurred so that the involved party cannot later improperly deny it.

Accountability focuses on tracing an action. Non-repudiation goes further by focusing on evidence that can substantiate the action.

Practical Controls

Section titled “Practical Controls”
  • Use digital signatures
  • Use trusted timestamps
  • Preserve important audit logs
  • Use WORM or immutable storage for evidence where appropriate
  • Preserve signer identity, signing time, and document content in electronic contract systems
  • Record approver identity, approval time, and approved data in workflow systems
  • Assign transaction IDs and request IDs to important operations
  • Define retention, preservation, and access requirements for evidentiary records

Example

Section titled “Example”

A digitally signed agreement with a trusted timestamp can provide evidence of who signed a particular document and when.

7. Reliability

Section titled “7. Reliability”

What Is Reliability?

Section titled “What Is Reliability?”

Reliability is the property of a system or service operating correctly, consistently, and as intended.

Reliability is related to availability but is not the same thing.

  • Availability: Is the service usable when needed?
  • Reliability: Does it behave correctly and consistently when used?

A service may technically be online but still be unreliable if it frequently returns incorrect calculations, loses transactions, or behaves unpredictably.

Practical Controls

Section titled “Practical Controls”

Build Quality In

Section titled “Build Quality In”
  • Perform unit, integration, and system testing
  • Automate tests in CI/CD
  • Use code review
  • Perform static analysis and dependency vulnerability checks
  • Validate releases in production-like environments

Keep Configurations Consistent

Section titled “Keep Configurations Consistent”
  • Use Infrastructure as Code (IaC)
  • Use configuration management
  • Reduce manual production changes
  • Track environment differences
  • Preserve change history

Monitor Service Quality

Section titled “Monitor Service Quality”
  • Define Service Level Indicators (SLIs) and Service Level Objectives (SLOs)
  • Monitor error rates, latency, and successful processing rates
  • Alert on abnormal conditions
  • Perform root-cause analysis and corrective actions after failures

Prevent Cascading Failures

Section titled “Prevent Cascading Failures”
  • Configure timeouts
  • Control retries
  • Use circuit breakers where appropriate
  • Isolate components
  • Design expected behavior for external dependency failures

Standardize Operations

Section titled “Standardize Operations”
  • Standardize release procedures
  • Apply change management
  • Maintain incident response procedures
  • Conduct failure and recovery exercises
  • Reduce dependence on unsupported software and undocumented individual knowledge

Understanding the Seven Elements Through One Example

Section titled “Understanding the Seven Elements Through One Example”

Consider an online service in which a customer submits a financial transaction.

Element Security question
Confidentiality Can another customer see the transaction data?
Integrity Can the amount or destination be altered without authorization?
Availability Can the customer submit the transaction when the service is required?
Authenticity Is the person submitting the transaction really the legitimate customer?
Accountability Can we determine who submitted, changed, or approved the transaction and when?
Non-repudiation Can we preserve evidence proving that the transaction or approval occurred?
Reliability Does the transaction processing system operate correctly and consistently?

This demonstrates why the seven elements are useful not merely as terminology but as security architecture and review questions.

What Should an Organization Actually Do?

Section titled “What Should an Organization Actually Do?”

Memorizing seven terms does not improve security by itself.

A practical implementation approach is to work through the following steps.

1. Identify What You Need to Protect

Section titled “1. Identify What You Need to Protect”

Create an inventory of information assets such as:

  • Customer data
  • Personal data
  • Contracts
  • Financial or transaction data
  • Authentication credentials
  • Source code
  • System configuration
  • Logs
  • Backups
  • Cloud accounts
  • Laptops and mobile devices

You cannot select appropriate controls until you know what must be protected.

2. Evaluate CIA Risks

Section titled “2. Evaluate CIA Risks”

For each important asset, ask:

  • What happens if this information is disclosed?
  • What happens if it is changed or destroyed?
  • What happens if it becomes unavailable?

Those three questions are a practical starting point for CIA analysis.

3. Establish Strong Identity and Access Control

Section titled “3. Establish Strong Identity and Access Control”

Implement controls such as:

  • MFA and passkeys
  • Least privilege
  • Unique user identities
  • Privileged access management
  • Periodic access reviews

These controls primarily support confidentiality and authenticity.

4. Protect Data and Changes

Section titled “4. Protect Data and Changes”

Use:

  • Version control
  • Peer review
  • Approvals
  • Hashes
  • Digital signatures
  • Database constraints
  • Backups

to protect integrity.

5. Preserve Audit Evidence

Section titled “5. Preserve Audit Evidence”

Record:

  • Who performed an action
  • When it occurred
  • Where it came from
  • What object or data was affected
  • What was changed

This is essential for accountability and non-repudiation.

6. Design for Continuity and Recovery

Section titled “6. Design for Continuity and Recovery”

Implement:

  • Redundancy
  • Monitoring
  • Backups
  • Disaster Recovery
  • RTO and RPO targets
  • DDoS protection
  • Recovery exercises

to protect availability.

7. Test and Improve Continuously

Section titled “7. Test and Improve Continuously”

Regularly perform activities such as:

  • Vulnerability assessments
  • Penetration testing
  • Backup restoration tests
  • Disaster recovery exercises
  • Incident response exercises
  • Access reviews
  • Audit-log reviews
  • Post-incident analysis
  • Security awareness training

The seven elements should be treated as ongoing risk-management objectives, not as a one-time checklist.

Is the CIA Triad No Longer Enough?

Section titled “Is the CIA Triad No Longer Enough?”

The CIA triad remains the core model of information security.

However, modern environments increasingly depend on cloud services, APIs, SaaS platforms, remote access, electronic contracts, digital identities, and online transactions. Organizations therefore also need to determine:

  • whether a person or system is genuine,
  • who performed an action,
  • whether that action can be proven later, and
  • whether systems behave consistently and correctly.

That is why Authenticity, Accountability, Non-repudiation, and Reliability provide useful additional perspectives beyond CIA.

Summary

Section titled “Summary”

The core CIA triad consists of:

  • Confidentiality: Prevent unauthorized disclosure
  • Integrity: Keep information accurate and complete
  • Availability: Keep information and services accessible when required

Four additional security properties are also useful:

  • Authenticity: Verify that identities, systems, and data are genuine
  • Accountability: Trace actions to responsible identities or systems
  • Non-repudiation: Preserve evidence so actions cannot be improperly denied
  • Reliability: Ensure systems operate correctly and consistently

The goal is not simply to memorize seven definitions.

The practical objective is to review your own information and systems through all seven perspectives and ask:

What could go wrong, what controls already exist, and what controls are still missing?

Using CIA as the starting point and then reviewing the four additional properties can help reduce blind spots in system design, security architecture, risk assessment, and operational controls.

References

Section titled “References”