Security governance is the framework of rules, processes, and accountabilities that an organisation uses to protect its information assets. It matters for the CISSP because every technical control you learn about later is designed to support a small set of core principles—confidentiality, integrity, and availability—that make up the CIA Triad. If you do not understand these three pillars, you cannot understand why any security tool exists or why organisations spend money on it.
Jump to a section
A simple way to picture Security Governance and Principles
A safe-deposit box in a bank vault is the central object in this scene. The vault has a heavy steel door with a combination lock, and inside are rows of small steel boxes, each with its own keyhole. You rent one of these boxes to store your grandmother's pearl necklace.
Confidentiality means that only you and the bank manager—who has a separate key—can open your specific box. No other customer, not even the cleaning staff, can peek inside. If someone else jimmies the lock or copies your key, confidentiality is broken.
Integrity means the necklace stays exactly as you left it—all the pearls strung in the correct order, with no scratches or missing clasps. If a bank employee accidentally knocks the box and scatters the pearls, then re-strings them in the wrong order, the integrity is damaged because the item no longer matches its original state.
Availability means you can access your box during bank hours. If the vault door is jammed, or the bank is suddenly closed for repairs, you cannot retrieve the necklace when you need it—like when you want to wear it to a wedding. Availability fails when authorised users cannot reach an asset at the required time.
Together, these three properties—confidentiality, integrity, availability—are called the CIA Triad. The bank builds its entire security process around keeping your box private, unchanged, and reachable. In cybersecurity, every control, from encryption to backups, exists to protect one or more of these three goals.
The CIA Triad stands for Confidentiality, Integrity, and Availability. These three properties are the foundation of all information security. Every policy, every firewall rule, every backup schedule is built to protect one or more of these three things. Think of them as the security goals that never change, even as technology evolves.
Confidentiality is the property that information is not disclosed to unauthorised individuals, entities, or processes. In plain English, it means keeping secrets secret. When you send a private message, confidentiality ensures that only the intended recipient can read it. Encryption is the most common technical control for confidentiality: it scrambles data so that anyone who intercepts it sees only gibberish. Access controls, like user IDs and passwords, also enforce confidentiality by allowing only approved users to view sensitive files. A breach of confidentiality occurs when a hacker steals credit card numbers from a database, or when an employee accidentally emails a client list to the wrong person.
Integrity is the property that information is accurate and complete and has not been modified in an unauthorised way. It means trusting that the data you see is the data that was originally created. If a bank records a deposit of 100 dollars, integrity says that number should still be 100 dollars tomorrow, not 1,000 dollars because someone altered the record. Hashing is a common integrity control: a mathematical algorithm produces a unique string of characters (a hash) for a piece of data. If the data changes even slightly, the hash changes completely, alerting you to tampering. Checksums and version control also preserve integrity. A breach of integrity happens when a virus modifies a system file, or when a disgruntled employee edits a financial spreadsheet to hide theft.
Availability is the property that information and systems are accessible and usable when needed by an authorised user. It means the system is up and running, and the data is reachable. If a website crashes during a sale, availability is lost. If a power outage takes down the company email server, availability is lost. Redundancy (having spare components) and backups (copies of data stored elsewhere) are the main availability controls. A denial-of-service (DoS) attack, which floods a server with traffic to make it crash, is a deliberate attack on availability.
These three principles are sometimes expressed as a triangle, and they often trade off against each other. For example, the most secure way to protect a file is to lock it in a safe and never let anyone touch it—that maximises confidentiality and integrity but destroys availability. Real security governance is about balancing the three according to the organisation's needs. Different data types require different balances. Your public-facing website must prioritise availability; your customer payment database must prioritise confidentiality and integrity.
Governance brings these principles to life through policies and procedures. A security policy is a high-level document that states management's intent—for example, 'All customer data will be encrypted at rest.' Standards are mandatory rules derived from policies—for example, 'Use AES-256 encryption for all databases.' Procedures are step-by-step instructions for following the standards—for example, 'Run the encryption wizard on the database server on the first of every month.'
When you study for the CISSP, you must memorise the CIA Triad definitions exactly. Exam questions will present a scenario—a stolen laptop, a corrupted file, a server outage—and ask which principle was violated. You must be able to distinguish them cleanly. Confidentiality is about unauthorised viewing. Integrity is about unauthorised modification. Availability is about access when needed.
Another important nuance: non-repudiation is sometimes discussed alongside the CIA Triad. Non-repudiation means that someone cannot deny having performed an action. For example, a digital signature on an email proves that you sent it and you cannot later claim you did not. Non-repudiation relies on integrity (the signature cannot be forged) and availability (the signature verification system must be working), but it is not itself one of the three core principles. The CISSP exam treats non-repudiation as a related but separate concept.
Classify the Data
The organisation identifies all information assets and labels them by sensitivity level—public, internal, confidential, or restricted. This step determines which CIA principles deserve the most attention for each asset. For example, a public marketing brochure needs availability more than confidentiality, while a customer credit card list needs confidentiality and integrity above all.
Perform a Risk Assessment
The organisation evaluates threats and vulnerabilities for each classified asset. For confidential patient records, the risk of a data breach (violating confidentiality) may be rated high, while the risk of server downtime (violating availability) may be rated medium. This step prioritises which principle to invest in first.
Define Governance Policies
Senior management writes high-level policies that state the organisation's commitment to the CIA Triad. For example, 'All customer payment data must be encrypted at rest and in transit.' These policies are formal documents that create accountability and set mandatory requirements for all employees.
Implement Technical and Administrative Controls
Based on policies, the IT team deploys specific controls. For confidentiality, they set up encryption and access controls. For integrity, they enable logging and hashing. For availability, they implement redundant systems and backups. Administrative controls include training and acceptable use agreements that teach staff how to preserve the CIA principles daily.
Monitor and Audit Continuously
The organisation regularly reviews logs, tests backups, and conducts vulnerability scans to verify that confidentiality, integrity, and availability are being maintained. If a violation is detected, corrective action is taken—such as restoring an altered file (integrity), resetting a compromised password (confidentiality), or adding server capacity (availability).
Consider a medium-sized company called MediFirst Health that operates a chain of clinics. They store patient medical records in an electronic health record (EHR) system. Sarah is the newly hired information security officer. She starts by performing a risk assessment to identify which data is most sensitive. She finds that patient diagnoses, treatment plans, and insurance details are the highest-value assets.
Sarah's first job is to establish governance for protecting these records. She writes a data classification policy that labels every record as 'Confidential'. She then creates a set of standards:
All medical records must be encrypted using AES-256 while stored on the server (encryption at rest).
All data transmitted between clinics and the main data centre must use TLS 1.3 (encryption in transit).
Only clinicians and billing staff may access the records; other employees need explicit approval.
Next, Sarah works with the IT team to implement controls. They set up role-based access control (RBAC) in the EHR system. Each user is assigned a role—doctor, nurse, administrator—and each role has a specific set of permissions. A doctor can view and update patient notes; a nurse can view but not edit diagnoses; an administrator cannot see clinical data at all. This enforces confidentiality because only authorised roles see sensitive information.
To protect integrity, the IT team enables logging. Every time a record is created, read, updated, or deleted, the system logs the user ID, timestamp, and the exact change made. If a nurse accidentally changes a dosage from 10mg to 100mg, the audit log captures it, and Sarah can trace who made the change and revert it. Additionally, the database uses checksums to detect if a record has been tampered with by malware.
For availability, the company deploys redundant servers in two different geographic locations. If the primary data centre loses power, the secondary site takes over automatically. Full backups are performed nightly and stored in a separate cloud account. Sarah also contracts with a disaster recovery provider that can restore the entire system within four hours if both data centres fail.
Sarah's governance framework does not stop at technical controls. She writes acceptable use policies for employees, mandating that they lock their screens when leaving their desks and never share passwords. She trains all staff annually on the CIA Triad and how their actions affect it. If a clinician leaves a patient file open on a public screen, that is a confidentiality violation, and the clinician receives a written warning.
What does Sarah actually do day to day? She reviews access logs for unusual patterns, such as a billing clerk accessing surgical records. She tests the backup restoration process quarterly to verify integrity. She runs vulnerability scans to identify weaknesses that could threaten availability. She reports to the board of directors annually on the state of the CIA Triad across all systems. Her job is to ensure that governance turns the abstract principles of confidentiality, integrity, and availability into concrete, auditable actions.
The CISSP exam tests the CIA Triad heavily because it is foundational to every other domain. Expect at least three to five questions directly about confidentiality, integrity, or availability, and many more that reference these principles indirectly. The exam does not just ask you to define them—it tests your ability to apply them to realistic situations.
Here are the specific question types and traps you will encounter:
Scenario-based identification. The exam gives you a short story: 'A company's e-commerce website goes down on Black Friday, preventing customers from placing orders. Which principle has been compromised?' The answer is availability. The trap is that beginners often choose 'confidentiality' because they associate 'security' with keeping things secret. In this scenario, no secret was leaked; the system simply was not working.
Prioritisation questions. 'An organisation has limited budget and must choose between implementing encryption and installing a redundant power supply. Which should be prioritised for a customer database containing credit card numbers?' The correct answer is encryption, because the database's highest risk is unauthorised viewing (confidentiality), not downtime (availability). The trap is trying to choose both equally. The exam expects you to weigh the specific data's sensitivity.
Integrity vs. availability confusion. A common trap question describes a file that becomes corrupt and cannot be opened. Some beginners answer 'availability' because the file is not accessible. But the root cause is a modification that damaged the file's accuracy, which is an integrity issue. The rule: if the content changed without authorisation, it is integrity. If the content is fine but the system is down, it is availability.
Non-repudiation tie-ins. The exam sometimes asks, 'Which CIA principle does a digital signature primarily support?' The correct answer is integrity, because the signature proves that the data has not been altered. However, some study materials incorrectly associate digital signatures with non-repudiation only. On the exam, if the question asks about the CIA Triad specifically, always map it to integrity. Non-repudiation is a separate concept that is tested on its own.
Dual-principle scenarios. Some scenarios violate two principles. For example: 'A hacker steals a backup tape and then modifies the data on it.' This violates confidentiality (the data was viewed by an unauthorised person) and integrity (the data was changed). The exam may ask you to identify both or to choose the primary one. Always read carefully for the word 'primary' or 'most directly affected'.
Key definitions to memorise verbatim:
Confidentiality: prevents unauthorised disclosure.
Integrity: prevents unauthorised modification.
Availability: ensures timely and reliable access.
Trap patterns they love:
Using 'authentication' as a distractor for confidentiality.
Using 'authenticity' as a distractor for integrity.
Suggesting that availability is 'nice to have' rather than a security requirement.
Asking which principle is 'least important'—the exam expects you to say that importance depends on the asset, not that any principle is universally less important.
The CIA Triad is the foundation of all information security: Confidentiality prevents unauthorised viewing, Integrity prevents unauthorised modification, and Availability ensures authorised access when needed.
No single principle is inherently more important than another; the priority depends on the specific asset, the organisation's risk appetite, and legal or regulatory requirements.
Exam scenario questions about a stolen laptop typically test confidentiality, but if the laptop contained encrypted files that were also altered, integrity is also violated.
Non-repudiation is a separate concept from the CIA Triad, though it relies on integrity to ensure that an action cannot be denied.
Security governance turns abstract CIA principles into concrete policies, standards, and procedures that drive everyday technical controls.
Data exists in three states—at rest, in transit, and in use—and each state requires different controls to preserve confidentiality, integrity, and availability.
These come up on the exam all the time. Here's how to tell them apart.
Confidentiality
Prevents unauthorised disclosure of information.
Is a technical security property.
Applies to any type of data, not just personal data.
Privacy
Governs how personal data is collected and used.
Is a legal and ethical concept.
Applies only to personally identifiable information (PII).
Integrity
Ensures data has not been modified without authorisation.
Is compromised when a file is corrupted or altered.
Controls include hashing, checksums, and version control.
Availability
Ensures data and systems are accessible when needed.
Is compromised when a server crashes or network goes down.
Controls include redundancy, backups, and load balancing.
Encryption (confidentiality)
Scrambles data so it cannot be read without a key.
Is reversible if you have the decryption key.
Protects data in transit and at rest.
Hashing (integrity)
Produces a fixed-size string that represents the original data.
Is one-way—you cannot reverse a hash to get the original data.
Detects if data has been tampered with.
Policy
States management's intent and high-level requirements.
Is broad and strategic.
Example: 'All sensitive data must be encrypted.'
Procedure
Provides step-by-step instructions for completing a task.
Is detailed and tactical.
Example: 'Open the encryption tool, select the folder, and click Encrypt.'
Mistake
Confidentiality and privacy are the same thing.
Correct
Confidentiality is a security property that prevents unauthorised access to information. Privacy is a legal and ethical concept that governs how personal data is collected, used, and shared. You can have confidentiality without privacy (e.g., a company keeps your data secret but uses it in illegal ways) and privacy without confidentiality (e.g., you share your data willingly but the company sells it to third parties without your knowledge).
The terms are loosely used interchangeably in everyday conversation. Beginners often assume that if data is secure, it is automatically handled correctly from a privacy standpoint, but security and privacy are separate disciplines.
Mistake
Integrity means that data is correct and unaltered. This applies to every type of information. For example, a clinical trial's dosage records must have integrity to ensure patient safety. A software update file must have integrity so that users do not install malware. Even a simple employee directory listing needs integrity to avoid misdirected emails.
Correct
People naturally associate integrity with money because financial errors have obvious consequences. They overlook non-financial contexts where altered data can cause harm or liability.
Mistake
Confidentiality is always the most important principle.
Correct
No principle is inherently more important than the others; importance depends on the asset and the context. For a public news website, availability is far more important than confidentiality. For a military weapons blueprint, confidentiality is paramount. For a medical dosage calculator, integrity is critical. The CISSP exam expects you to evaluate trade-offs, not default to one principle.
Beginners often come from a general 'security means secrecy' mindset. They have not yet learned that security is about balancing multiple goals based on risk.
Mistake
Availability is just about having backup power.
Correct
Availability involves many layers beyond power. It includes network resilience (redundant internet connections), hardware redundancy (failover servers), software patch management (to prevent crashes from bugs), capacity planning (to handle traffic spikes), and protection against denial-of-service attacks. A single power backup does not guarantee availability if the network cable is cut.
Availability is the most tangible principle to a beginner—they have experienced a server outage. But they oversimplify it to a single solution, not realising how many components must work together.
Mistake
The CIA Triad is only for data at rest.
Correct
The CIA Triad applies to data in all three states: at rest (stored on a disk), in transit (moving across a network), and in use (being processed in memory). A database at rest must be encrypted (confidentiality). Data transmitted over the internet must be encrypted with TLS (confidentiality and integrity). Data in use, such as a password being checked in RAM, must be protected against memory-scraping malware (confidentiality and availability).
Beginners think of data as sitting in a file on a hard drive. They forget that data moves constantly—during backups, replication, user access, and processing—and is vulnerable in each state.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The CIA Triad stands for Confidentiality (keeping secrets secret), Integrity (making sure data is accurate and unaltered), and Availability (making sure data and systems are accessible when needed). It is the foundation of all security thinking.
You balance the three by assessing the risk to each principle for a given asset. For example, a public website needs high availability, so you invest in redundant servers. A HR database needs high confidentiality, so you prioritise encryption and strict access controls. There is no one-size-fits-all balance.
No, non-repudiation is a separate security goal. It means someone cannot deny having performed an action, such as sending an email. It relies on integrity to ensure the evidence cannot be forged, but it is not one of the three core CIA principles.
Confidentiality is a security property that prevents unauthorised disclosure. Privacy is a legal and ethical concept about how personal data is collected, used, and shared. You can have confidentiality without privacy and vice versa.
Because every other domain—from access control to cryptography to disaster recovery—exists to support one or more of the three principles. Understanding the CIA Triad gives you a mental model for evaluating any security control.
Yes. For example, a ransomware attack encrypts files (confidentiality is broken because the attacker can read them) and makes them inaccessible (availability is lost). If the attacker also modifies the files, integrity is violated too.
You've finished Security Governance and Principles. Continue through the CISSP study guide to build a complete picture of the exam.
Done with this chapter?