ISO 27001 Principles

An ISO/IEC 27001 management system is designed to preserve three principles of information security: confidentiality, integrity, and availability, together known as the CIA triad. The table below defines each principle and gives an example of the risk it addresses:

Principle	Meaning	Risk Example
Confidentiality	Only the right people can access the information held by the organization.	Criminals get hold of your clients’ login details and sell them on the Darknet.
Information integrity	Data that the organization uses to pursue its business or keeps safe for others is reliably stored and not erased or damaged.	A staff member accidentally deletes a row in a file during processing.
Availability of data	The organization and its clients can access the information whenever it is necessary so that business purposes and customer expectations are satisfied.	Your enterprise database goes offline because of server problems and insufficient backup.

An information security management system that meets the requirements of ISO/IEC 27001 preserves the confidentiality, integrity and availability of information by applying a risk management process and gives confidence to interested parties that risks are adequately managed.