CIA Triad

What is the CIA triad?

The CIA triad is the foundational model of information security that defines three goals: the confidentiality, integrity and availability of information and systems. Every security control, from a password to a firewall, contributes to at least one of these three goals. In the Netherlands the same model is known as BIV, after the Dutch words for availability, integrity and confidentiality. In OT environments the priorities are reversed to AIC, with safety as an overarching goal above all three.

🧠 What do confidentiality, integrity and availability mean?

• Confidentiality — only authorised people and systems can access information. Think of recipes, PLC code, network diagrams and passwords.
• Integrity — information and systems are accurate, complete and not modified without authorisation. In OT this means setpoints, measured values, control logic and firmware.
• Availability — information and systems can be used when they are needed. For a process plant this means the control system runs around the clock and responds within the required time.

The vocabulary standard ISO/IEC 27000, which underpins ISO 27001, literally defines information security as the preservation of confidentiality, integrity and availability of information.

🕰️ Where does the CIA triad come from?

The idea predates the acronym. The US Anderson Report of 1972 and the 1975 paper The Protection of Information in Computer Systems by Saltzer and Schroeder already described three kinds of violation: unauthorised release, unauthorised modification and unauthorised denial of use. The acronym CIA is attributed to Steve Lipner, around 1986. Since then the triad has sat at the heart of almost every security framework, from the ISO 27000 series to the US FIPS 199 categorisation and the Dutch government baseline BIO.

🔄 Why does OT reverse the order to AIC?

In office IT a data breach is usually the biggest concern, so confidentiality comes first. In OT the system controls a physical process: an outage or manipulation can cause lost production, environmental damage or injury. NIST SP 800-82 Rev. 3 (2023) therefore states that OT puts integrity and availability ahead of confidentiality, with safety as an overarching priority. Hence the term AIC triad.

Note that the order is a rule of thumb, not a law. Many OT specialists rank integrity equal to, or even above, availability. A plant running on manipulated measurements is more dangerous than one that has stopped safely. This is most obvious for a safety instrumented system: there, the integrity of the safety function matters more than keeping the process running.

🧱 What extensions to the CIA triad exist?

The triad does not cover everything. In 1998 Donn Parker proposed the Parkerian hexad in his book Fighting Computer Crime, with six elements:

• Confidentiality, integrity and availability — the classic three
• Possession or control — who holds the data or system, even if nobody has read it
• Authenticity — does a command or message really come from the sender it appears to come from
• Utility — is the information still usable, for example a backup whose decryption key has been lost

Many frameworks also add non-repudiation: a user cannot later deny having performed an action. In OT, authenticity and non-repudiation matter most for changes to PLC logic and for commands sent to field devices, which many classic industrial protocols, such as Modbus, do not verify.

🔧 How do the IEC 62443 requirements map to the CIA triad?

The IEC 62443 series does not work with C, I and A directly but with seven foundational requirements (FRs). IEC 62443-3-3 elaborates them into system requirements per security level. Their relation to the triad:

Strikingly, only one of the seven FRs is purely about confidentiality, while integrity and availability recur in nearly all of the others. FR5 underpins the zones and conduits model.

⚠️ Which OT incidents violated which CIA goal?

🛠️ How do you classify an OT system using CIA ratings?

A CIA (or BIV) classification determines, per aspect, how strongly a system needs protecting. Dutch government bodies often use a scale of 1 to 3 per letter, where 111 is low and 333 is maximum. Here is how you would approach it for, say, the SCADA system of a sewage pumping station:

1. Define the scope — which components, networks and data belong to the system, and which process does it control?
2. Assess the impact per aspect — use a business impact analysis: what happens after an outage of an hour, a day, a week? What if setpoints change unnoticed? What if the network design leaks?
3. Weigh safety separately — if a violation can cause injury or environmental harm, integrity or availability automatically gets the highest rating.
4. Apply the high-water mark — the most severe aspect sets the overall level, as in the US FIPS 199 and FIPS 200.
5. Translate into controls — link the classification to a target security level per zone in the risk assessment under IEC 62443-3-2.
6. Record and review — document the decision and repeat the classification after every major change.

A typical result for such a pumping station is A3, I3, C2: an outage or manipulation can cause sewer overflows and flooding, affecting the environment and public health, whereas leaked drawings help an attacker but cause no harm by themselves. For Dutch public bodies, BIO2, adopted on 23 September 2025, is risk-based: the old fixed baseline security levels have gone, but the CIA trade-off remains the starting point.

🔐 Does confidentiality not matter in OT?

That is a persistent misconception. Confidentiality ranks lower in OT, but it is far from irrelevant:

• Reconnaissance precedes sabotage — attacks such as Stuxnet and TRITON began by gathering design data and configurations. Leaking network plans and PLC programs makes the next attack easier.
• Intellectual property — recipes, process parameters and batch formulas are often a plant’s most valuable business data.
• Credentials — a leaked password for remote access violates confidentiality first, and integrity and availability right after.

Encryption and access control therefore belong in OT too, provided they do not jeopardise the real-time requirements of the process.

❓ Frequently asked questions

What is the difference between CIA and BIV?

CIA and BIV are the same model in a different language and order. CIA stands for confidentiality, integrity and availability; BIV is the Dutch abbreviation for beschikbaarheid, integriteit and vertrouwelijkheid. The Dutch government uses BIV in the BIO baseline and in BIV classifications.

What does AIC mean in OT security?

AIC is the CIA triad in reverse order: availability, integrity, confidentiality. The term signals that OT systems above all need to keep running and process correct values, while confidentiality carries less weight. Safety sits above all three.

Where does safety fit in the CIA triad?

Safety is formally not part of the CIA triad, but in OT it is treated as an overarching goal above all three. NIST SP 800-82 explicitly names safety as an overarching priority. In OT, a security control must never compromise a safety function.

Is the Parkerian hexad better than the CIA triad?

The Parkerian hexad is an extension of the CIA triad rather than a replacement, adding possession, authenticity and utility. For OT, authenticity is the most useful addition, because many industrial protocols do not check who sends a command. In standards and legislation the CIA triad remains the common model.

How does IEC 62443 relate to the CIA triad?

IEC 62443 translates the CIA triad into seven foundational requirements, from identification and authentication control (FR1) to resource availability (FR7). FR3 covers integrity, FR4 confidentiality and FR7 availability, while the remaining FRs support several goals at once.

Which CIA goal did Stuxnet violate?

Stuxnet mainly violated the integrity of the process: it manipulated centrifuge speeds and pressures while feeding the control logic and operators recorded normal values. That makes Stuxnet the textbook example of an integrity attack on OT, with physical damage as the result.

📌 In summary

The CIA triad describes confidentiality, integrity and availability; in OT the order is reversed to AIC, with safety above all three. Use a CIA classification to decide which aspect weighs heaviest for each system, translate it into controls per zone through IEC 62443, and do not neglect confidentiality: reconnaissance is the first step of every OT attack.