CIA Triad vs CIAS Model

In cybersecurity, Confidentiality, Integrity and Availability for the "CIA Triad" that served to define the purpose of cybersecurity. The CIA Triad concept is meant to balance these principles as a “three-legged stool” where all three legs are needed, or the stool topples over.

In 2017, ComplianceForge published the Confidentiality, Integrity, Availability & Safety (CIAS) replacement for the traditional CIA Triad. With embedded technologies (e.g., Internet of Things (IoT) and Operational Technology (OT)) and the rise of Artificial Intelligence (AI) and autonomous technologies (AAT), the lack of a safety component makes the CIA Triad insufficient to define the concept of what cybersecurity is meant to perform.

Protecting an organization's data and the systems that collect, process and maintain this data is of critical importance. Commensurate with risk, cybersecurity and privacy measures must be implemented to guard against unauthorized access to, alteration, disclosure or destruction of data and systems, applications and services. This also includes protection against accidental loss or destruction.

Key Takeaways - CIA Triad vs CIAS Model

The CIA Triad (Confidentiality, Integrity, Availability) has been the foundational model for cybersecurity, but it was designed before IoT, OT and AI existed at scale.
ComplianceForge introduced the CIAS Model in 2017, adding Safety as a fourth pillar to address technologies that can cause physical harm if compromised.
Safety addresses the risk of death, injury, illness, or equipment damage and loss from technologies that could fail or be manipulated by threat actors.
The CIAS model is now reflected in the Secure Controls Framework (SCF) and ComplianceForge documentation products.
Applying CIAS to risk management provides a more complete picture of cybersecurity requirements across all technology types.

The New Model

Confidentiality, Integrity, Availability & Safety (CIAS) Model

The security of systems, applications and services must include controls and safeguards to offset possible threats, as well as controls to ensure confidentiality, integrity, availability and safety:

CONFIDENTIALITY – This addresses preserving authorized restrictions on access and disclosure to authorized users and services, including means for protecting personal privacy and proprietary information.
INTEGRITY – This addresses protecting against improper modification or destruction, including ensuring non-repudiation and authenticity.
AVAILABILITY – This addresses timely, reliable access to data, systems and services for authorized users, services and processes.
SAFETY – This addresses reducing risk associated with technologies that could fail or be manipulated by nefarious actors to cause death, injury, illness, damage to or loss of equipment.

Operationalizing CIAS

Applying The CIAS Model To Risk Management

When you overlay real-world examples onto the CIAS model, it becomes clear how the CIAS model can help communicate cybersecurity and data protection requirements.