How it works
Confidentiality limits who can read data. Integrity limits who can change data. Availability keeps systems usable when needed.
Match each control to the part of CIA it protects. Access control often protects confidentiality and integrity; backups support availability and recovery.
Common error
A control can support more than one goal, but AP answers should name the goal most directly tied to the scenario.
Worked example
Separate three security goals for a student-record application.
Evidence
Unauthorized reading: confidentiality
Unauthorized grade change: integrity
Service outage: availabilityThe primary goal follows the harm, not the product name. Access restrictions can protect reading and editing; audit records support investigation; tested recovery and resilience support availability. A single control may help several goals without completely satisfying any of them.
Exercises
5.1.1
An attacker changes a posted exam schedule while the site stays online. Which goal is most directly affected?
Show solution
Integrity: the information was altered without authorization. The site being reachable does not make the information trustworthy.
5.1.2
Why do backups support recovery but not automatically prevent unauthorized disclosure?
Show solution
Backups can restore lost or damaged data, but a person may still read an exposed copy. Backup access must also be controlled and sensitive copies protected.