The CIA Triad: Confidentiality, Integrity, Availability

The CIA triad is the three-part standard security professionals use to judge whether a control actually protects data: confidentiality, integrity, and availability. Every tool a practice buys, from a firewall to an email filter to backup software, exists to serve one or more of these three goals. The National Institute of Standards and Technology (NIST), the federal agency that sets U.S. cybersecurity and technology standards, uses the CIA triad as a foundation throughout its Cybersecurity Framework.

Understanding the CIA triad lets you ask sharper questions before spending money on protection, and spot the gap when a vendor's pitch covers only one leg of the stool. The same three goals apply whether you run a tax practice, a healthcare office, or any other small business handling sensitive customer data.

Confidentiality: Only the Right People See the Data

Confidentiality means information is available only to people authorized to see it, whether that's client Social Security numbers, patient records, or internal financials. You protect confidentiality with access controls, encryption, and authentication, such as requiring multi-factor authentication (MFA) before someone logs into practice management software. For any small business, the same logic applies to employee records, financial data, or customer payment information, not just tax or health records. Our guide to two-factor authentication for tax professionals covers what strong authentication looks like in 2026.

Email is one of the most common places confidentiality breaks down, since a single misdirected or phished message can expose client files. Encryption is the backstop for data that does get accessed or intercepted; our encryption guide explains which data should be encrypted at rest and in transit.

Integrity: The Data Is Accurate and Unaltered

Integrity means the data hasn't changed, whether by accident, a system error, or deliberate tampering, and that you would know if it had. A tax return altered after signature, a patient record with the wrong dosage entered, or a database corrupted mid transfer are all integrity failures. For a retailer or professional services firm, an integrity failure could just as easily be a corrupted invoice total or a customer record changed without a trace in the system logs.

Integrity controls include checksums, version history, audit logs, and keeping software patched, since unpatched systems are a common way attackers gain the access needed to alter data undetected. Our patch management guide walks through building that habit into a regular schedule.

Availability: The Data Is There When You Need It

Availability means authorized users can reach the systems and data they need, when they need them. This is the leg of the triad that ransomware attacks target directly: encrypting files doesn't expose or alter their content, it just makes them unavailable until the business pays or restores from backup. For any small business, an availability failure could mean a point-of-sale system down during business hours or an email server unreachable right when a client needs a signed document.

Availability controls include redundant backups, disaster recovery planning, and monitoring for outages. Our ransomware protection guide covers how to keep a ransomware incident from becoming a total availability failure.

Why the CIA Triad Isn't Just Theory for Regulated Practices

For healthcare practices, the CIA triad is a legal reference point, not just a security concept. The HIPAA Security Rule, issued by the Department of Health and Human Services (HHS), requires covered entities to "ensure the confidentiality, integrity, and availability of all electronic protected health information" they create, receive, maintain, or transmit, under 45 CFR 164.306. That means a HIPAA risk analysis is, in practice, a CIA triad exercise applied to patient data. See our healthcare security resources for how this plays out for practices.

Accounting and tax firms face a parallel structure under the FTC Safeguards Rule, which requires a written information security program addressing access controls, encryption, and monitoring, the same three concerns mapped to confidentiality, integrity, and availability. Our Safeguards Rule checklist breaks the requirement into specific tasks.

NIST's foundational publication on the topicSpecial Publication 800-12, describes the triad as the basis for defining security requirements before selecting any control. If your firm works with a third-party provider, ask how its service covers all three pillars, not just whether a tool exists on paper.

Even outside a specific regulatory requirement, the same logic holds for any small business handling sensitive customer data. See our small business compliance overview for how these obligations generally apply outside of a single framework.