Security Objectives of Information SecurityCIA, Authenticity and the Path to ISMS

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

In hardly any other field are terms so readily mixed as here. Information security, IT security, data security, data protection, cybersecurity – in everyday life, they often stand for each other. In an audit, a contract, or a damage case, they do not.

This article sorts the terms, explains the three security objectives, and shows how they lead to a robust decision – and where information security meets business continuity.

The Terms, Clearly Separated

• Information Security is the umbrella term encompassing the protection objectives of confidentiality, integrity, availability of all information assets – regardless of whether they are digital, on paper, or in an employee’s mind.^[1]
• IT Security is the part limited to information technology systems. A filing cabinet does not fall under this, but a file server does.
• Data Security is a technical sub-area of information security and protects data regardless of personal reference.^[1]
• Data Protection refers exclusively to personal data according to the GDPR^[2] and is legally defined in Article 4 and Article 5.
• Cybersecurity extends IT security to include the entire cyber space, including networked systems and attack scenarios, as defined in the BSI Act’s definitions^[3].

The practical benefit of this distinction: Anyone who says „data protection“ and means information security brings the wrong responsibility into the house. A data protection officer is not responsible for the availability of the ERP system, and an information security officer is not responsible for the legality of consent.

The Protection Objectives of Information Security

Confidentiality

Information is accessible only to those who are authorised to have it. It is breached by unauthorised access – externally through an attack, internally through overly broad permissions, and more often than expected through simple misaddressing.

Integrity

Information is complete and unaltered. This protection objective is most often underestimated. An attacker who steals data causes damage. An attacker who alters data and no one notices causes more damage – because work continues based on incorrect data.

Availability

Information and systems are usable when needed. Here, information security directly intersects with Business Continuity Management – more on that below.

Where Risks Arise

Risks do not arise randomly. They occur where threats meet vulnerabilities and structural deficits. A vulnerability is usually technical – an unpatched system, an open interface, a missing verification mechanism. A structural deficit is organisational – a lack of emergency planning, an unclear authorisation concept, a responsibility that no one has.

Between this core and the organisation lie two rings: technical and organisational measures – abbreviated as TOM in practice and data protection law – together with compliance, the binding requirements that guide the measures. The denser these rings, the less of what arises in the core reaches the organisation above.

This is also where governance comes into play. Organisational guidelines – policies, roles, approval paths, training – are not just paperwork alongside technology. They are the ring that keeps structural deficits small. Those who only secure technically leave the inner half open and later wonder why a well-patched system fails due to a process error.

The path of a risk to the organisation. Risks here are potential dangers and threats. They only become detrimental to the organisation when they pass through the ring of vulnerabilities and structural deficits and subsequently the ring of technical and organisational measures (TOM) and compliance. Illustration: NOVELEDGE.

At the core of these rings are the risks. Risk describes the uncertainty regarding objectives – the range of how far the outcome can deviate from what is intended to be achieved. What this exactly means, how this range can be assessed and managed, and why the positive direction is also included, is explained in the article on risk management.

The Four Impact Levels of a Risk

A risk only becomes tangible when one asks, what it impacts. The same cause – such as unnoticed access – affects a different level depending on the protection objective and requires different measures. Therefore, it is worthwhile to go through each level individually: What is the problem, where does it come from, what helps against it.

The four levels at a glance: The slide set shows each individually with problem, causes, and measures. Click through – the detailed explanation is below in the text.

Slide set “Information Risk“ by NOVELEDGE.

Availability

“It works when I need it.“

Problem: Facilities and systems enter a state where they are not present, not accessible, or cannot be used to the intended extent when needed.

Causes: Technical vulnerabilities such as software errors, structural deficits like a lack of emergency planning, external events such as a power outage.

Measures: Redundancies, high availability, monitoring, emergency plans from Business Continuity Management.

Integrity

“The data is as it should be.“

Problem: Unauthorised or unnoticed changes to data, systems, or processes.

Causes: Lack of verification mechanisms and unprotected interfaces as vulnerabilities; unclear processes, lack of control, or absence of a four-eyes principle as structural deficits; manipulation, unauthorised access, and technical errors as threats.

Measures: Cryptography such as hashing and signatures, access controls, logging and monitoring, backups.

Confidentiality

“Confidentiality protects against unauthorised access.“

Problem: Unauthorised insight into information by unauthorised persons.

Causes: Inadequate access controls and unencrypted data as vulnerabilities; lack of authorisation concepts and unclear responsibilities as structural deficits; data theft, phishing, insider threats, and espionage as threats.

Measures: Access controls and role models, encryption at rest and in transit, network segmentation, employee awareness training.

Authenticity

“Authenticity creates trust in identities.“

Authenticity is the extended impact level. It is not listed in every enumeration of protection objectives, but in practice, it often determines whether the other three are upheld at all.

Problem: Identities, communication partners, or systems are not who they claim to be.

Causes: lack of authentication mechanisms and weak identity verification as vulnerabilities; unclear identity processes and lack of training as structural deficits; phishing, social engineering, and man-in-the-middle attacks as threats.

Measures: Multi-Factor Authentication (MFA), certificates and digital signatures, Identity and Access Management (IAM), awareness training.

Four Key Statements

Security is reflected in four questions: available, correct, protected, and trustworthy.

From Protection Objectives to Decision-Making

Determining Protection Needs

Protection objectives alone do not dictate what actions to take. The bridge to decision-making is the determination of protection needs, often referred to as the CIA classification after the initial letters of the English protection objectives.

Each information object is individually assessed to determine the severity of damage if confidentiality, integrity, or availability were compromised. Typically, there are three levels: normal, high, very high.

Two factors determine the quality of the outcome:

• Evaluate separately. An object can be very high in confidentiality and normal in availability. A personnel file is a good example: highly confidential, but if it is unavailable for a day, little happens. For a production control system, it is the opposite.
• The business units evaluate, not IT. IT knows the systems, but not the damage. Only those who work with the application understand what its failure means for the business.

Only from the protection needs does it become clear which measures are appropriate. Without it, either everything is protected equally – which is expensive – or based on gut feeling, which is incomplete.

The ISMS

Security as a Management System

Individual measures fade over time. An Information Security Management System (ISMS) is the organisational framework that ensures security does not depend on individual commitment. It essentially includes:

• a policy supported by management
• clear roles and responsibilities
• a recurring risk analysis
• derived and prioritised measures
• Effectiveness review and improvement

The last point distinguishes a functioning ISMS from a folder on a shelf. Measures whose effectiveness is never reviewed are mere declarations of intent.

The PDCA Model

Security is a state that must be maintained

Why a management system and not a list of measures? Because security is not an achievable end state. It is a state that must be maintained – and this is precisely what the PDCA model of Plan, Do, Check, and Act represents. It is the fundamental principle behind quality and security standards: ISO/IEC 27001, ISO 22301^[4] and the BSI Standard 200-1^[5] all operate with it.

Plan

Planning and Conceptualisation

• Define objectives and framework conditions
• Determine the scope of risk and protection needs analysis
• Establish information security and BCM strategy
• Plan processes, controls, and responsibilities

Do

Implementation of Planning

• Implement controls
• Training and awareness
• Ensure operation of processes
• Activate documentation and communication

Check

Success Control and Monitoring of Goal Achievement

• Monitoring and measurement
• Audits and evaluation
• Identify deviations
• Analyse results

Act

Optimisation and Improvement

• Corrective and improvement measures
• Adjust processes and controls
• Reassess risks
• Continuous improvement

The cycle does not close once, but repeatedly. An ISMS that is set up once and then left alone becomes a file folder after two years. Only repetition turns the model into a management system.

Two Established Approaches

BSI IT-Grundschutz

The IT-Grundschutz^[5] provides a methodology with the BSI Standards of the 200 series and a comprehensive catalogue of specific requirements with the IT-Grundschutz Compendium. Strength: very specific, available in German, free of charge, established in the public sector and with KRITIS^[6].

Current Development: The BSI is working on IT-Grundschutz++, a fundamental revision. The core is a significant consolidation of requirements, stronger prioritisation instead of full implementation of all modules, an expanded role model, and a machine-readable format. The published information on binding transition and certification deadlines varies; the publications of the BSI itself are decisive.

ISO/IEC 27001

The international standard for ISMS. Strength: internationally recognised, in demand in tenders and supplier evaluations, more streamlined in structure. It describes what a management system must achieve and allows more freedom in the how.

For selection, a simple rule of thumb applies: Those who deliver internationally or want to certify tenders can hardly avoid ISO/IEC 27001^[6]. Those operating in the German public environment or in the KRITIS area often achieve concrete results faster with IT-Grundschutz. A combination is possible and common.

Where Information Security and Business Continuity Meet

Availability is the protection goal both disciplines work towards – from different angles.

Information security asks: How do I prevent a system from failing or being manipulated? Business Continuity Management asks: What do I do if it happens anyway?

Both require the same preliminary work. The determination of protection needs provides an assessment of how severe a failure would be. The Business Impact Analysis additionally provides the time dimension: when does it become critical, what recovery time must be achieved, which processes take priority.

In practice, both surveys are often conducted separately – by different departments, with different questionnaires, in the same specialist areas. This costs double the time and ultimately provides two assessments of the same situation that do not match. A joint survey is a greater gain than any individual refinement of methods.

From Voluntary to Mandatory

For a long time, an ISMS was a business decision. That has changed. The NIS2-Umsetzungsgesetz^[6] explicitly requires affected entities to conduct risk analysis, develop security concepts, implement access control, use cryptography, and maintain operations – and holds management personally accountable.

We have detailed who is affected, what deadlines apply, and what management is liable for in the article NIS2 in Germany. For operators of critical facilities, the KRITIS-Dachgesetz also applies.

Significance for the Organisation

Organisations do not need to prevent all attacks, but they must be able to manage them. Five statements that summarise the whole:

1. Security is an interplay of several disciplines. Information security, cybersecurity, data security, and data protection only work together.
2. The greatest risks arise from simple entry points. Identities, vulnerabilities, and deception are the focus of current attacks – not exotic technology.
3. Effectiveness arises in implementation. Technical and organisational measures are decisive, not concepts alone.
4. Control requires transparency. Key figures and situational reports make the security level visible and thus controllable.
5. The goal is resilience, not absolute security. The ability to react and recover is crucial.

How to Start

• Capture values. What information and systems are there at all? Without this list, any further work is an estimate.
• Determine protection needs, separately according to confidentiality, integrity, and availability, assessed by the specialist areas.
• Start with the critical objects. Completeness is a distant goal; effectiveness begins at the top.
• Clarify roles. Who is the information security officer, who owns which values, who decides on residual risks?
• Choose a framework – IT-Grundschutz or ISO/IEC 27001 – and not both halfway.
• Integrate with the Business Impact Analysis before both surveys start separately.

Support from NOVELEDGE

For the determination of protection needs, we offer CIA Classification as a Service, and for the joint assessment of protection needs and recovery times, the CIA BIA as a Service. An overview of all templates and services can be found in the Shop.

Status: September 2026. The further development of IT-Grundschutz to IT-Grundschutz++ is ongoing; binding deadlines are published by the BSI. This article does not replace legal or certification advice.

Sources

The information in this article is based on the following sources. Paid standards are not quoted verbatim; their contents are reproduced in essence.

1. ISO/IEC 27000 – Terms and definitions of information security, Section 3. ↑
2. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation, GDPR). Freely available at EUR-Lex. ↑
3. Act on the Federal Office for Information Security and on the Security of Information Technology of Facilities (BSIG). Freely available at gesetze-im-internet.de. ↑
4. DIN EN ISO 22301:2020-06 – Security and Resilience – Business Continuity Management System – Requirements (ISO 22301:2019). Publisher: DIN Deutsches Institut für Normung e. V., Berlin. Available for purchase through standards trade. ↑
5. Federal Office for Information Security: BSI Standard 200-1 – Management Systems for Information Security (ISMS). Freely available at BSI. ↑
6. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS-2 Directive). Freely available at EUR-Lex. ↑