CIA triad

The "CIA triad" of confidentiality, integrity, and availability sits at the heart of many information security standards. The concept was introduced in the Anderson Report in 1972 and later repeated in The Protection of Information in Computer Systems. The abbreviation was coined by Steve Lipner around 1986. The triad is used in information-security standards and guidance, including the ISO/IEC 27000 family of standards and the NIST Cybersecurity Framework. ISO/IEC 27000 defines information security as the preservation of confidentiality, integrity and availability of information, while other frameworks use the three concepts as part of wider approaches to managing cyber and information-security risk. Although the CIA triad remains influential, authors have argued that it is incomplete as a general model of information security. Alternative and expanded models have proposed additional goals such as authenticity, possession or control, utility, non-repudiation, accountability and trust. These additions are sometimes presented as separate principles, and sometimes as extensions or intersections of confidentiality, integrity and availability.