Every control and every incident maps to at least one of these. If you can’t name which, you don’t understand the impact yet.

• C — Confidentiality — who can see it
• I — Integrity — was it changed
• A — Availability — can we use it

Breaks

• C — data leak, stolen laptop, mis-share
• I — ransomware encrypt, poisoned update
• A — DDoS, disk full, deleted backups

Controls

• C — encryption, access control, DLP
• I — hashing, signing, least privilege
• A — redundancy, backups, rate limits