A company is developing a disaster recovery plan for its internal network. What is the CIA triad component targeted in the scenario?

A disaster recovery plan (DRP) is fundamentally designed to restore information systems and data access following a disruptive event, such as a natural disaster or major system failure. The primary objective is to minimize downtime and ensure that services are accessible and usable by authorized users as quickly as possible. This directly aligns with the principle of Availability from the CIA triad, which ensures timely and reliable access to and use of information and systems.

A. Innovation: This is not a component of the CIA security triad (Confidentiality, Integrity, Availability) and is irrelevant to the core principles of information security.

B. Confidentiality: This principle focuses on preventing the unauthorized disclosure of information. While a DRP may include measures to protect data, its primary goal is restoration of service, not secrecy.

D. Integrity: This principle ensures that data is trustworthy and has not been subject to unauthorized modification. A DRP aims to restore systems, which is a prerequisite for ensuring data integrity.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Section 1

Introduction

Page 1: "Contingency planning supports this effort by establishing thorough plans

procedures

and technical measures to enable the recovery of information systems

operations

and data after a disruption. The primary goal... is to restore normal operations as quickly as possible and protect the assets of the organization

thereby ensuring the availability of critical resources..."

2. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education.

Chapter 1

Section 1.2

"The Meaning of Computer Security"

Page 6: The text defines availability as the ability for authorized entities to use a system or resource. It explicitly states

"An object or service is available if... it is present in a usable form... and it is not denied to authorized users." Disaster recovery directly addresses threats to this property.

3. Whitman

M. E.

& Mattord

H. J. (2019). Principles of Information Security (6th ed.). Cengage Learning.

Chapter 2

"The Need for Security"

Section on "CIA Triad": This section explains that disaster recovery and business continuity plans are the primary controls that support the principle of availability. It describes availability as enabling authorized users—persons or computer systems—to access information without interference or obstruction and to receive it in the required format.