Study ISC2 CC information assurance: confidentiality, integrity, availability, authentication, non-repudiation, and privacy.
Information assurance is the first decision layer in many CC questions. Before selecting a control, decide which security objective is being protected.
| Objective | Exam meaning | Common control examples |
|---|---|---|
| Confidentiality | prevent unauthorized disclosure | access control, encryption, classification, need-to-know |
| Integrity | prevent unauthorized or undetected change | hashing, digital signatures, change control, logging |
| Availability | keep systems and data usable when needed | redundancy, backups, monitoring, capacity, DR planning |
| Authentication | prove an identity | passwords, MFA, certificates, biometrics |
| Non-repudiation | reduce ability to deny an action | digital signatures, audit logs, timestamps |
| Privacy | handle personal data properly | consent, minimization, retention, masking, legal compliance |
If the stem says data was viewed by the wrong person, think confidentiality. If data was modified without approval, think integrity. If users cannot access the system, think availability. If the issue is proving a person or system really performed an action, think accountability and non-repudiation.
ISC2 now folds foundational AI security into the CC outline. At this level, keep it simple:
| Trap | Better instinct |
|---|---|
| encryption always solves privacy | privacy also needs lawful handling, retention, access limits, and minimization |
| backup equals availability | backups help recovery, but availability may also require redundancy and tested restore |
| authentication equals authorization | proving identity is not the same as granting permission |
| logs automatically prove everything | logs need integrity, time sync, retention, and review |
A customer file is accidentally emailed to the wrong external recipient. The first concern is confidentiality/privacy, not availability. The stronger response includes reporting, containment, policy review, and evidence, not just changing a password.