Scenario: An employee at Reyae Ltd unintentionally sent an email containing critical business strategies to a competitor due to an autofill email…

The scenario describes a two-stage information security incident. The first event is the unintentional sending of an email with sensitive data to an unauthorized party (a competitor). This action directly compromises confidentiality, which is the principle of preventing the unauthorized disclosure of information. The second event involves the competitor altering the received information. This action is a direct violation of integrity, which is the principle of maintaining the accuracy and completeness of data. Therefore, the sequence of events correctly maps to a confidentiality breach followed by an integrity violation.

B. Reyae Ltd's integrity was compromised first, while the competitor's actions led to an availability violation: The initial breach was an unauthorized disclosure (confidentiality), not data alteration (integrity). The competitor's actions did not make the data unavailable.
C. Reyae Ltd's availability was compromised first, while the competitor’s actions led to an integrity violation: The initial breach did not concern the accessibility of information (availability) but its secrecy. The information was disclosed, not made inaccessible.

1. ISO/IEC 27000:2018, Information technology — Security techniques — Information security management systems — Overview and vocabulary.

Clause 3.10 (Confidentiality): Defines confidentiality as the "property that information is not made available or disclosed to unauthorized individuals, entities, or processes." This directly applies to the email being sent to the competitor.

Clause 3.36 (Integrity): Defines integrity as the "property of accuracy and completeness." This is violated when the competitor "altered the information."

2. PECB. (2022). ISO/IEC 27001 Lead Implementer Training Course Material. Day 1: Introduction to Information Security Management Systems (ISMS) and ISO/IEC 27001.

The course material establishes the Confidentiality, Integrity, and Availability (CIA) triad as the fundamental objective of an Information Security Management System. It explains that a confidentiality breach occurs upon unauthorized disclosure, which is the first event in the scenario.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Chapter 2, Section 2.2, "The Pillars of Information Security": This section details the CIA triad. It clarifies that confidentiality is about protecting information from unauthorized access and disclosure, while integrity is about safeguarding the accuracy and completeness of information and processing methods. The scenario presents a classic example of these two principles being breached in sequence.