What does CIA stand for?
CIA stands for Confidentiality, Integrity, and Availability. The three core security goals: confidentiality (only authorized people see data), integrity (data is not altered undetected) and availability (systems work when needed).
The CIA triad names the three goals of information security. Confidentiality means only authorized people can read the data. Integrity means the data is accurate and has not been changed without authorization. Availability means the data and systems are there when needed. Most exam questions about a control or an attack come down to which of the three it protects or harms.
CIA in practice: an example
Encrypting a laptop protects confidentiality if it is stolen. A hash published next to a download protects integrity, because a changed file gives a different hash. A second power supply protects availability. Ransomware attacks availability, and confidentiality too when the data is also stolen.
What CIA is confused with
CIA vs AAA: what is the difference?
The CIA triad is about goals for data. AAA, authentication, authorization and accounting, is about controlling and recording access. What AAA stands for
Which exams cover CIA?
CIA is on the official CompTIA acronym list for two of the four exams covered here.
- Security+ SY0-801: 1.1 (General Security Concepts).
- Network+ N10-009: 4.0 (Network Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. An attacker changes the amount in a payment file in transit. Which part of the triad is violated?
- Confidentiality
- Integrity
- Availability
- None
Show the answer
B. Integrity. The data was altered without authorization. Integrity controls such as hashes and digital signatures detect this.
2. A denial-of-service attack takes a booking site offline for a day. Which goal is affected?
- Confidentiality
- Integrity
- Availability
- Non-repudiation
Show the answer
C. Availability. The service cannot be reached by legitimate users. Nothing was read or changed.
Sources: NIST FIPS 199, Standards for Security Categorization; NIST glossary: confidentiality. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.