CIA Triad Scenario Sorter: Confidentiality, Integrity or Availability?
The CIA triad is the three goals of information security: confidentiality (only authorized people can see the information), integrity (it is not improperly changed or destroyed) and availability (it can be used when needed). Read the definitions, then sort 15 real-world incidents and see why each belongs where it does.
TL;DRThe short version
5 points
- The CIA triad is the three core goals of information security: confidentiality, integrity and availability. It is not about the intelligence agency.
- NIST SP 800-12 Rev. 1 defines information security as protecting information and systems from unauthorized access, use, disclosure, disruption, modification or destruction "in order to ensure confidentiality, integrity, and availability".
- FIPS 199 gives a one-line test for each loss: unauthorized disclosure (confidentiality), unauthorized modification or destruction (integrity), disruption of access or use (availability).
- Sort 15 scenarios below. Every answer is explained, and the tricky ones say so, such as deletion counting as an integrity loss.
- It runs in your browser; your answers are not sent anywhere.
The three definitions, from NIST
Confidentiality
“Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.”
A loss of confidentiality is the unauthorized disclosure of information.
Integrity
“Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.”
A loss of integrity is the unauthorized modification or destruction of information.
Availability
“Ensuring timely and reliable access to and use of information.”
A loss of availability is the disruption of access to or use of information or an information system.
Definitions as quoted in FIPS 199, which attributes them to 44 U.S.C. 3542. Loss descriptions are FIPS 199 wording.
An HR employee emails a spreadsheet of staff national ID numbers to the wrong external address.
Which property is lost first and most directly?
How the triad is used in practice
FIPS 199 has US federal agencies rate the potential impact of a loss of each property as low, moderate or high, separately for each of the three properties. For a moderate rating, for example, the standard describes a serious adverse effect on operations, assets or individuals. The resulting profile drives which controls are needed. The same habit works for any organisation: for each system, ask what would happen if the data leaked, was altered, or could not be reached.
To see the idea applied, use the Threat Model Builder to find where each property is at risk, the Risk Register to record the ratings, and the OSI Model Attack Map to place attacks by layer. The DDoS Readiness Scorecard is an availability check.
Sources
- NIST, FIPS 199, Standards for Security Categorization of Federal Information and Information Systems (February 2004), definitions and impact levels, read in the published PDF on 3 November 2026.
- NIST, SP 800-12 Rev. 1, An Introduction to Information Security (June 2017), section 1.4 Important Terminology.
Last reviewed 3 November 2026. The scenarios are illustrative teaching examples, not reports of real incidents.
Frequently asked questions
What is the CIA triad?
The CIA triad is the three security objectives confidentiality, integrity and availability. NIST SP 800-12 Rev. 1 defines information security as protecting information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction to ensure confidentiality, integrity and availability.
What does confidentiality mean?
FIPS 199 quotes 44 U.S.C. 3542: "Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information." A loss of confidentiality is the unauthorized disclosure of information. Encryption and access control protect it.
What does integrity mean?
FIPS 199 quotes 44 U.S.C. 3542: "Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity." A loss of integrity is the unauthorized modification or destruction of information. Hashes, digital signatures and change control protect it.
What does availability mean?
FIPS 199 quotes 44 U.S.C. 3542: "Ensuring timely and reliable access to and use of information." A loss of availability is the disruption of access to or use of information or an information system. Redundancy, backups and DDoS protection support it.
Which one is most important?
It depends on the system. Secrecy of a trade secret, correctness of a bank ledger and uptime of an emergency service weight the three differently. FIPS 199 does not rank them; it asks organisations to rate the potential impact (low, moderate or high) of losing each one separately for each of the three properties.
Can one incident break more than one property?
Yes. Ransomware that steals files and then encrypts them breaks confidentiality and availability. Deleting data breaks integrity and, if there is no backup, availability too. The sorter asks which is lost first and most directly, and the explanations point out the others.
Is there a fourth or fifth element?
Some models add authenticity, accountability or non-repudiation. FIPS 199 folds non-repudiation and authenticity into its definition of integrity, which is the approach used here.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.