The availability pillar involves ensuring that data is accessible to those that have permission to access it when they need to have access to it. Not only do the information systems that host the data need to be functioning in a reliable manner, but so do the security systems that protect the data, as well as the networking systems that are used to connect to the systems that host the data. This means that organizations need to ensure that the information systems that host the data as well as those systems’ security and infrastructure dependencies are highly available.

To meet the availability pillar of the CIA triad, data and information systems should remain available when information systems are under a predictable load. For example, there were substantial problems with the 2016 Australian Census as the Australian Bureau of Statistics moved from manual to electronic collection of census data. On census evening, the systems for handling the collection of that data failed, meaning that the agency missed collecting census data on a substantial percentage of the Australian population on the census date.

To meet the availability pillar of the CIA triad, an organization needs to ensure that data remains available after information systems become unavailable, either through equipment failure, data corruption, or natural disaster. This means that organizations also need an effective disaster recovery strategy, regularly moving backed-up data to offsite locations. Doing this will ensure that the data will remain recoverable if the primary storage site suffers a catastrophic failure or the data itself becomes corrupted either deliberately or inadvertently

Join the discussion

What aspects of information security aren’t adequately encapsulated by the CIA Triad? Use the discussion section below and let us know your thoughts. Once you’re happy with your contribution, click the Mark as complete button to check the step off, then you can move to the next step.