The three fundamental protection objectives form the backbone of an ISMS:
1. Confidentiality
Objective: Information may only be accessed or processed by authorized persons.
Measures: Access controls, encryption, data protection guidelines, role and rights management
Example: Only the HR team may access salary data.
2. Integrity
Objective: Information must be accurate and complete and must not be altered without evidence.
Measures: Checksums, digital signatures, change logs (audit trails)
Example: An invoice may no longer be edited after approval.
3. Availability
Objective: Information and IT systems must be reliable and accessible when needed.
Measures: Backup strategies, redundancy, emergency plans, protection against outages or attacks (e.g., DDoS)
Example: An online shop must be available around the clock, even under high load.
These core objectives are complemented by additional important security aspects that are relevant in the context of a modern ISMS:
- Authenticity: Ensuring that a communication partner or piece of information is genuine
- Accountability / Non‑repudiation: Traceability of actions, for example, who made which change and when
- Data Protection: Especially regarding personal data – interface with the GDPR to the GDPR