What it means
Objectives convert broad concern into a clear statement of what must be protected and why. Confidentiality limits unauthorized disclosure, integrity limits unauthorized change or destruction, and availability ensures timely, reliable access. Other objectives add confidence in identity and origin, traceability, privacy, safety, and continuity.
How it works
Teams identify objectives for each business process, data set, system, and transaction, then assign priorities based on consequence. Controls are selected and assessed against those objectives. Different assets may need very different balances even within the same organization.
A public information site prioritizes availability and integrity while accepting broad read access. A confidential investigation system requires strict confidentiality and authenticity, yet it must also remain available to authorized responders during an emergency.
Practical focus
- State objectives for specific assets and use cases
- Rank consequences instead of assuming every objective is equal
- Trace controls and tests to the objective they support
- Reassess objectives when business use or threat conditions change
Common mistakes
- Using the CIA triad as a checklist without defining consequences
- Ignoring authenticity, accountability, privacy, safety, or resilience
- Selecting controls before agreeing on the required outcome
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: