Beyond the CIA Triad: The Five Properties That Actually Keep Data Safe
Ask almost anyone who has studied for a security certification to name the foundation of the field, and you will hear three letters: CIA. Not the agency — confidentiality, integrity, and availability. This trio, usually drawn as a triangle, is the model that organizations use to design, structure, and implement a security program. It is the first substantive concept in Domain 1 of the CISSP, and it is the vocabulary every practitioner reaches for when they explain why a control exists.
But the triangle has quietly grown two more corners. Modern security guidance — and, as it turns out, U.S. federal law — recognizes two additional properties that the classic triad does not cleanly capture: authenticity and nonrepudiation. Together with CIA, these are often called the five pillars of information security. This article walks through all five: what each one means, why the model expanded, and the part that most checklists skip — the fact that these properties routinely pull against one another.
Start with the triangle: confidentiality, integrity, availability
The CIA triad is described in the Destination CISSP study guide as “a foundational model that helps organizations design, structure, and implement the security function.” Here is what each pillar actually protects.
Confidentiality prevents unauthorized disclosure. It keeps information in the hands of the people who are supposed to have it and out of everyone else’s. In practice, confidentiality is enforced through two principles that are worth knowing by name:
- Need-to-know — you get access only to the specific information required to do your job, nothing more.
- Least privilege — you get the minimum level of permission (read, write, delete) needed for that job, nothing more.
Encryption, access controls, and classification schemes all serve confidentiality. When a laptop is stolen and the data on it is encrypted, confidentiality held even though physical control was lost.
Integrity protects assets from unauthorized or accidental change. The study guide frames integrity as adding value by keeping assets “more accurate, more timely, more current, more meaningful” — a useful reframing, because integrity is not only about blocking malicious tampering. A fat-fingered spreadsheet edit, a corrupted database write, or a botched software update all damage integrity just as surely as an attacker does. The everyday technical tool here is hashing: run a file through a hash function before and after transit, compare the two fingerprints, and any change — deliberate or accidental — shows up immediately.
Availability ensures that assets are accessible when the people who need them actually need them. A system that is perfectly confidential and perfectly accurate but unreachable during a crisis has failed its users. Redundancy, backups, failover, and capacity planning all serve availability. A ransomware attack is, at its core, an availability attack: the data is still there and still intact, but you cannot get to it.
The subtle upgrade: from “information security” to “asset security”
There is a point in the Destination CISSP treatment of the triad that is easy to skim past but genuinely changes how you think about the job. The three pillars are traditionally called the “goals of information security” — but that framing is too narrow.
Security does not protect only information. It protects anything that represents value to an organization — people, facilities, equipment, reputation, and data alike. All of these are assets. So the guide argues the pillars are better understood as the goals of asset security, not merely information security. It is a small wording change with a large consequence: it stops you from designing a program that hardens the database while leaving the loading dock, the badge system, and the people wide open.
Why three became five
The traditional triad answers three questions: Is it secret? Is it accurate? Is it available? But those three do not answer two others that modern digital transactions depend on completely: Is this really from who it claims to be from? And can the person who did this later deny they did it? That gap is why the model expanded. Two more pillars fill it.
Authenticity proves the source and origin of an asset — that it is legitimate and bona fide, and can be trusted and verified. It is frequently described as “proof of origin.” When your browser shows a padlock and confirms you are actually talking to your bank’s server and not an impostor, that is authenticity at work, delivered through digital certificates. When an email is cryptographically signed so the recipient can confirm it genuinely came from the sender, that too is authenticity.
Nonrepudiation provides assurance that someone cannot deny having done something — the inability to refute accountability or responsibility for an action. If you digitally sign a contract, you cannot later credibly claim someone else signed it, because the signature is cryptographically bound to you. Nonrepudiation is what makes digital agreements, audit logs, and financial transactions legally and operationally meaningful. Without it, every “I never sent that” would be unfalsifiable.
Notice how tightly authenticity and nonrepudiation are related, yet distinct. Authenticity is about verifying who originated something. Nonrepudiation is about making that origin undeniable after the fact. The first answers “who is this from?”; the second answers “can they wriggle out of it later?”
These aren’t just study-guide vocabulary — they’re written into law and standards
It would be easy to treat the five pillars as an exam mnemonic. They are considerably more than that. The same properties are encoded in the standards and statutes that govern real organizations.
U.S. federal law defines information security in these exact terms. Under Title 44 of the U.S. Code, Section 3552 — the definitions section of the Federal Information Security Modernization Act (FISMA) — “information security” means protecting information and systems in order to provide integrity, confidentiality, and availability. The statute then defines each: confidentiality as “preserving authorized restrictions on access and disclosure”; availability as “ensuring timely and reliable access to and use of information”; and, notably, integrity as “guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity.” In other words, U.S. law folds authenticity and nonrepudiation directly into its statutory definition of integrity — a strong signal that these are not optional add-ons.
NIST, the U.S. standards body, builds its federal security-categorization standard, FIPS 199, on those same three security objectives — confidentiality, integrity, and availability — drawn from the statutory definitions above. This is the framework federal agencies use to rate a system’s impact level as low, moderate, or high.
ISO/IEC 27000, the international vocabulary standard for information security management systems, defines information security as the “preservation of confidentiality, integrity and availability of information.” The standard also notes that other properties — including authenticity, accountability, nonrepudiation, and reliability — can be involved as well. So the world’s most widely adopted security-management standard lands in the same place the CISSP material does: a core triad, plus additional properties that a mature program accounts for.
The convergence is the point. A study guide, a U.S. statute, a NIST standard, and an ISO standard all describe security using the same handful of properties. When four independent sources agree on the shape of a model, that model is worth internalizing.
The part most people miss: the pillars fight each other
Here is the insight that turns this from memorization into judgment. The five properties are not a checklist you can max out simultaneously. They trade off against one another, and security work is largely the art of balancing them for a specific context.
- Push confidentiality to its extreme — encrypt everything, require multiple approvals for every access — and you erode availability, because legitimate users now struggle to reach what they need quickly.
- Push availability to its extreme — replicate data everywhere, cache it widely, remove friction — and you widen the attack surface for confidentiality.
- Add heavyweight integrity and nonrepudiation controls — sign and verify every transaction, log everything immutably — and you can degrade availability and performance under load.
A hospital and a stock exchange both need all five properties, but they weight them differently. For emergency medical records, availability often wins: a doctor must reach the chart now, even if that means slightly looser access friction. For a financial trade, nonrepudiation and integrity dominate: the transaction must be provably attributable and unaltered, even if that adds latency. There is no universally “correct” balance — only the balance that fits what the asset is worth and what it is for.
That is why understanding the five pillars matters beyond passing an exam. Every real security decision — which control to add, which to relax, where to spend the budget — is a decision about which of these properties to favor, and by how much, for this particular asset. The model does not make the decision for you. It gives you the language to make it deliberately instead of by accident.
Key Takeaways
- The classic CIA triad has three pillars: confidentiality (no unauthorized disclosure, enforced through need-to-know and least privilege), integrity (no unauthorized or accidental change), and availability (accessible when needed).
- Integrity is not only about attackers. Accidental corruption — a bad edit, a failed update — breaks integrity too. Hashing is the everyday tool for detecting any change.
- The triad expanded to five pillars by adding authenticity (“proof of origin” — verifying where something truly came from) and nonrepudiation (making that origin undeniable after the fact, so no one can credibly deny an action they took).
- Think “asset security,” not just “information security.” The pillars apply to everything of value — people, facilities, reputation — not only to data.
- These properties are codified in law and standards, not just study guides: FISMA’s statutory definition (44 U.S.C. § 3552) even bundles nonrepudiation and authenticity into integrity, and both NIST (FIPS 199) and ISO/IEC 27000 are built on the same core triad.
- The pillars trade off against each other. Maximizing one often weakens another. Good security is choosing the right balance for a specific asset’s value and purpose — not maxing out all five at once.
This article is for general educational purposes only and does not constitute professional, legal, or security advice.
Sources & References
- Witcher, R., Berti, J., Hablas, L., & Mitropoulos, N. (2024). Destination CISSP: A Concise Guide (2nd ed.), Domain 1, Section 1.2.1 — Confidentiality, Integrity, Availability, Authenticity, and Nonrepudiation. Destination Certification, Inc.
- 44 U.S.C. § 3552 — Definitions (Legal Information Institute, Cornell Law School)
- NIST FIPS 199 — Standards for Security Categorization of Federal Information and Information Systems
- ISO/IEC 27000 — Information security management systems — Overview and vocabulary
- NIST Computer Security Resource Center — Glossary: security service
This article is for general educational purposes only and does not constitute professional, legal, or security advice.
