Confidentiality

Confidentiality is an information security principle that requires information to be accessible only to authorized individuals, entities, or processes. It focuses on controlling access and preventing unauthorized viewing, use, disclosure, or copying of data, whether in physical or digital form.

In the context of ISO 27001 and an Information Security Management System (ISMS), confidentiality is implemented through defined controls and procedures, such as:

• Access control mechanisms (e.g., user accounts, roles, permissions)
• Classification and handling rules for information
• Non-disclosure and confidentiality agreements
• Use of secure communication channels and encryption
• Physical and environmental security for information assets

Confidentiality is one of the three core components of the CIA triad (Confidentiality, Integrity, Availability) that underpin information security management.