Skip to main content
Bureau of AI
Category: Adversarial Security

Availability, Integrity, Confidentiality

Also known as: CIA, CIA Triad, Confidentiality, Integrity, and Availability, CIA Model
Simply put

The CIA triad names three core goals of protecting information: keeping it confidential (accessible only to those authorized to see it), maintaining its integrity (keeping it accurate and unaltered), and ensuring its availability (making sure it can be accessed when needed). These three principles are commonly used together as a foundational model for evaluating how well information is protected. Weakness in any one of the three can undermine the value of the others.

Formal definition

The CIA triad is a widely referenced information security model built on three properties: confidentiality, the protection of information from unauthorized access or disclosure; integrity, the assurance that data is trustworthy, complete, and has not been altered in an unauthorized or accidental manner; and availability, the assurance that information and systems are accessible to authorized users when required. As commonly defined, these properties are treated as interdependent objectives against which controls and risks are assessed rather than as a ranked hierarchy. Note that the triad originates in and is primarily framed for information and cyber security; it is distinct from AI governance and model risk management concepts, though it can inform the security dimension of controls applied to AI systems and their data. Some practitioner frameworks extend the model beyond these three properties (for example, adding authenticity or non-repudiation), so scope may vary by source and context.

Why it matters

The CIA triad matters because it provides a durable, widely referenced structure for reasoning about what can go wrong with information and the systems that hold it. Rather than treating security as a single undifferentiated goal, the triad separates three distinct objectives—confidentiality, integrity, and availability—so that controls and risks can be assessed against each. This separation is useful precisely because a control that strengthens one property may do little for another, and a threat may compromise one property while leaving the others intact. As several practitioner sources emphasize, the three are interdependent: confidentiality provides little value if data is unavailable when needed, and integrity is undermined if unauthorized users can manipulate records.

For professionals working in AI governance and model risk management, the triad is relevant chiefly as a security lens applied to the data and systems underpinning AI, not as a substitute for governance or model risk concepts. The confidentiality, integrity, and availability of training data, model artifacts, and inference infrastructure can bear directly on whether a model behaves as intended and whether its outputs can be trusted. However, the triad originates in and is primarily framed for information and cyber security; it does not by itself address concerns such as model performance degradation, fairness, or explainability, which fall outside its scope.

Because the triad is a model rather than a binding standard, its exact boundaries vary by source. Some practitioner frameworks extend it beyond the three core properties—for example, adding authenticity or non-repudiation—so professionals relying on the triad should confirm which definition a given framework or counterparty is using rather than assuming a single universal formulation.

Who it's relevant to

Information security and cybersecurity teams
The triad is a foundational model for these teams, providing a common vocabulary for classifying risks and mapping controls to the objectives of confidentiality, integrity, and availability. It is most directly at home in this discipline, where it originated.
Model risk managers and data scientists
For those managing AI and model-related risk, the triad offers a useful lens on the security of data and systems that feed and support models. It should be understood as informing the security dimension of controls rather than as covering model risk concerns such as performance degradation, validation, or fairness, which lie outside its scope.
AI governance and policy specialists
Governance professionals may reference the triad when specifying security expectations for AI systems and their data. It is worth noting that the triad is a security model distinct from governance frameworks; it can inform security requirements within a governance program but does not itself establish accountability structures or oversight processes.
Auditors and compliance officers
The triad provides a structured basis for assessing whether information protection measures address each of the three properties. Auditors should confirm which definition a given framework uses, since some sources extend the model beyond the three core properties, and the triad is a model rather than a binding legal standard.

Inside CIA

Confidentiality
The property that information is not disclosed to unauthorized individuals, entities, or processes. In an AI context this commonly extends to protecting training data, model parameters, prompts, inference inputs and outputs, and any personal or sensitive data processed by the system.
Integrity
The property that data and system components are accurate, complete, and not altered in an unauthorized or undetected manner. For AI systems this typically encompasses the integrity of training data, model weights, pipelines, and outputs, guarding against tampering such as data poisoning or unauthorized model modification.
Availability
The property that authorized users can access a system and its resources when needed. For AI systems this often includes the availability of inference endpoints, supporting data stores, and dependent infrastructure, and the resilience of these components against disruption.
The triad as a security framing (the 'CIA triad')
Availability, Integrity, and Confidentiality are commonly presented together as a foundational model for framing information security objectives. As commonly defined, they describe properties to be preserved rather than specific controls, and are typically balanced against one another based on context.
Relationship to AI governance and model risk
These properties intersect with AI governance (through policies and oversight that set security and data-handling expectations) and with model risk management (where compromised integrity or availability can affect model behavior and reliability). The triad addresses security properties and does not on its own constitute either governance or a full model risk framework.

Common questions

Answers to the questions practitioners most commonly ask about CIA.

Is the ordering 'Availability, Integrity, Confidentiality' just a rearrangement of the CIA triad, and does the order change what the properties mean?
The three properties are the same commonly defined information security objectives regardless of the order in which they are listed; reordering does not change the definition of each property. A common misconception is that a particular sequence signals a priority ranking that applies universally. In practice, any prioritization among the three is context-dependent and typically reflects the specific system, threat model, and organizational risk appetite rather than an inherent hierarchy implied by the listing order.
Do these three properties, once addressed, mean an AI system's risks are fully covered?
No. Availability, integrity, and confidentiality are information security properties and, as commonly defined, do not by themselves cover the full range of concerns associated with AI systems. Model-specific risks, governance, fairness, explainability, and performance considerations typically fall outside these three properties. Treating them as a complete risk framework is a frequent error; they are better understood as one component that may sit alongside, not in place of, broader AI governance and model risk management measures. Addressing them reduces certain risks but does not eliminate risk.
How can availability, integrity, and confidentiality be applied to the data used to train or operate a model?
As commonly practiced, availability concerns whether training or inference data can be accessed when needed; integrity concerns whether that data remains accurate and unaltered; and confidentiality concerns whether access is restricted to authorized parties. Implementation typically involves access controls, change tracking, and measures to keep data available for authorized use. The specific controls chosen depend on the system and organizational context, and this entry does not prescribe a single mandatory set.
Where might responsibility for these properties sit across lines of defense?
Responsibilities are often distributed rather than owned by a single group. In many organizational models, operational teams that build and run systems handle day-to-day controls, a separate risk or security function provides oversight, and internal audit provides independent assurance. The exact allocation varies by organization, and this entry does not assert a universally required structure. The distinction between these roles typically matters because the group operating a control is generally not the group that independently assesses it.
What kinds of controls typically support each of the three properties in an AI deployment?
In many implementations, availability is supported by measures aimed at keeping systems and data accessible for authorized use; integrity is supported by measures intended to detect or prevent unauthorized changes; and confidentiality is supported by measures that restrict access to authorized parties. The appropriate controls depend on the system, its risk profile, and applicable requirements. This entry describes the properties functionally and does not specify particular technologies or mandate a fixed control set.
How do these properties relate to monitoring an AI system over time?
Ongoing monitoring is commonly used to check whether the intended state of availability, integrity, and confidentiality is being maintained, since conditions and threats can change after deployment. It is worth distinguishing this security-oriented monitoring from monitoring of model performance, which addresses whether a model continues to perform as intended rather than whether these security properties hold. The two types of monitoring may run in parallel but are typically treated as distinct activities.

Common misconceptions

The CIA triad by itself is a complete AI governance or model risk management framework.
The triad describes security properties, not organizational oversight structures or the identification, measurement, monitoring, and control of model risk. It typically informs, rather than replaces, AI governance and model risk management, which address broader concerns such as accountability, validation, and performance monitoring.
Preserving these three properties eliminates security or model risk.
Maintaining availability, integrity, and confidentiality reduces and manages certain risks but does not eliminate them. Residual risk typically remains, and other risk categories relevant to AI, such as model performance degradation or fairness concerns, are not directly captured by the triad.
The three properties can all be maximized simultaneously without trade-offs.
In practice these objectives can be in tension; for example, controls that strengthen confidentiality may affect availability. As commonly framed, practitioners typically balance the three based on the system's context and risk tolerance rather than optimizing all equally.

Best practices

Define, for each AI system, which of the three properties are most critical given the system's use case and data sensitivity, and document the trade-offs made among them.
Extend confidentiality, integrity, and availability considerations across the full AI lifecycle, including training data, model parameters, pipelines, and inference endpoints, rather than treating security as a deployment-only concern.
Address integrity threats specific to AI, such as data poisoning or unauthorized modification of model weights, with controls to detect and prevent unauthorized alteration.
Coordinate these security properties with AI governance policies and model risk management processes, treating the triad as an input to those functions rather than a substitute for them.
Document residual risk after controls are applied and monitor for changes, recognizing that these measures manage rather than eliminate risk.
Where the triad's application to AI is evolving or context-dependent, use qualified language in internal documentation and avoid asserting that a single control set is universally sufficient.