Information security properties: 3 values across the catalogue

What this attribute records

Which characteristic of information the control helps to preserve. It answers a specific question: which property would we lose first if this control failed?

This attribute describes which property of information the control contributes to keeping: confidentiality, integrity or availability. It is the oldest vocabulary in the family, and it is the one most often recorded loosely. The published values are the three properties of the classic triad, and a control can carry more than one, because a backup protects availability and integrity at the same time.

The values of Information security properties in the published set

Value	Controls	What it means
Confidentiality	87	Information is not made available or disclosed to people or processes that are not authorised.
Integrity	84	Information is accurate, complete and protected against unauthorised change.
Availability	85	Information is accessible and usable when it is needed.

How to record it without creating a second catalogue

• One column, with every property the control actually protects, not only the dominant one.
• A link from the property to the asset or service it matters for, because 'confidentiality' in the abstract cannot be tested.
• The evidence that the property is protected: access rules, integrity checks, recovery tests.
• A note where the property clashes with another control, for example a logging control that protects integrity and creates a confidentiality risk.

Errors that cost an audit

• Marking every control with all three properties to avoid a decision.
• Recording the property of the data rather than the property the control protects.
• Forgetting availability for controls that look purely administrative, such as succession planning.
• Assuming the published value is wrong because the organisation's context differs; record the divergence and the reason instead.

The controls behind each value

Every control appears under each value it carries, so a control can appear more than once. The count is a count of rows, not a measure of strength.

Where this attribute is used

Each of the 93 control pages states this value in its attribute table, beside the other four. The kit exports the same value in the same column order, so a register built from it can be filtered by this attribute without reformatting. The free check uses your answer about the five attributes to place the work against your next audit.

All 93 controls The other attributes