What Are the Components of Data Security? A Complete Breakdown

Sources genuinely disagree on how many components data security has. Most agree on three core goals, confidentiality, integrity and availability, the CIA triad, while others list six by adding authentication, authorization and non-repudiation as separate supporting components.

What Are the Components of Data Security?

Here’s the honest answer most guides skip. There’s no single, universally agreed count. Some sources name three components. Others name six. Both are defensible, because they’re actually answering slightly different questions.

The three-component version describes goals: what data security is trying to achieve. The six-component version adds specific supporting mechanisms that help achieve those goals. Neither list is wrong. They’re just operating at different levels of the same idea, and knowing which level you’re looking at makes the whole topic far less confusing.

The CIA Triad: Confidentiality, Integrity, Availability, Explained Properly

Confidentiality means only authorized people can access specific data. A customer’s medical record, financial account or personal details should be visible only to those with a genuine, verified reason to see it.

Integrity means data stays accurate and unaltered unless changed through a legitimate, authorized process. If someone can quietly edit a financial record or medical prescription without detection, integrity has failed, even if confidentiality held perfectly.

Availability means authorized users can access data when they genuinely need it. A perfectly confidential, perfectly accurate database that’s been knocked offline by a ransomware attack has still failed at its job, since nobody who needs it can actually use it.

Together, these three goals define what data security is fundamentally trying to achieve. Every specific tool or control this article covers exists to serve one or more of these three.

Why Some Sources List Six Components Instead of Three

Three additional components frequently get added to the CIA triad, and each deserves a real explanation.

Authentication verifies who someone actually is, typically through a password, token, or biometric check, or some combination of these.

Authorization determines what that verified identity is actually permitted to do. Being authenticated doesn’t automatically mean being authorized for everything, an important distinction most people blur together.

Non-repudiation is the component nobody else actually explains properly, so here’s a genuine attempt. It means proving that an action genuinely happened and can’t be credibly denied afterward. Picture a financial transaction, an employee approving a large payment, or a document being signed electronically. If a dispute arises later, non-repudiation is what lets you prove, with real evidence, exactly who did what and when, rather than relying on someone’s word against another’s. This typically comes from audit logs that record actions in detail, and digital signatures that cryptographically tie a specific action to a specific identity, making it mathematically difficult to fake or deny after the fact.

Goals vs Mechanisms: The CIA Triad Tells You What to Protect

Here’s the organizing principle that resolves most of the confusion around this topic. The CIA triad names the goals, what you’re protecting and why it matters. Encryption, access control, and data backup and recovery are the mechanisms, the actual tools and processes that achieve those goals in practice.

Why does this distinction matter beyond tidy categorization? Confusing goals with mechanisms leaves people unable to explain why any specific tool actually exists. Encryption exists specifically to protect confidentiality, scrambling data so it’s unreadable without the right key. Access control exists to protect both confidentiality and integrity, restricting who can view or change something. Backup and recovery exists specifically to protect availability, ensuring data survives a ransomware attack, hardware failure, or accidental deletion. Every mechanism traces back to a specific goal it was built to serve. If you can’t say which goal a control protects, that’s usually a sign the control was chosen without a clear reason behind it, and gaps hide in exactly that kind of unexamined choice.

A Real Example: How One UK Enforcement Case Shows Every Component Failing at Once

Theory becomes concrete once you see it fail in real life. In 2012, the UK’s Information Commissioner’s Office fined Greater Manchester Police £120,000 after an unencrypted USB memory stick was stolen from an officer’s home during a burglary.

The stick held sensitive personal data on 1,075 people connected to serious crime investigations, gathered over 11 years. It had no password protection and no encryption, despite the force having already issued encrypted devices specifically for this purpose. The officer had simply switched to a larger, unencrypted stick once the official one filled up.

Watch how many components failed at once here. Confidentiality failed the moment the data left the building on an unencrypted device. Access control failed, since nothing actually stopped an unauthorized person from reading the stick’s contents once stolen. Authentication and authorization both failed, since there was no password gating access at all. And the ICO’s own investigation specifically found staff hadn’t been properly trained on data protection, meaning the human layer behind every technical control had failed too. One stolen device, sitting in a burglar’s hands, exposed every single component this article has covered, simultaneously, because none of them had actually been enforced.

What Does UK GDPR Require Regarding These Components?

UK GDPR Article 32 requires organizations to implement “appropriate technical and organisational measures” to protect personal data. It’s deliberately flexible rather than a fixed checklist, meaning what’s “appropriate” depends on your specific risk, not a universal standard applied identically to every business.

The ICO’s own encryption guidance is worth citing directly, and it’s genuinely current: the guidance is currently under review following changes introduced by the Data (Use and Access) Act, and organizations should check the ICO’s own site for the latest version rather than treating any single summary as permanently fixed. The guidance uses a “must, should, could” framework to clarify expectations, “must” reflecting binding legal requirements, “should” reflecting what the ICO expects absent a good reason not to, and “could” reflecting optional approaches worth considering. While UK GDPR doesn’t specifically mandate encryption for all personal data, the ICO strongly recommends it as a robust technical measure.

Cyber Essentials, the UK government-backed certification scheme, verifies baseline technical controls, including access control and secure configuration, giving smaller organizations a concrete, achievable standard to work toward rather than an abstract legal phrase to interpret alone.

How Do These Components Work Together in Practice?

Here’s what a coherent approach actually looks like, tying every piece covered above into one sequence.

Data classification comes first, identifying what data actually needs protecting and how sensitive it is, since you can’t apply the right controls to information you haven’t identified as important.

Access control, whether Role-Based Access Control assigning permissions by job function, or Attribute-Based Access Control making more granular decisions based on multiple factors at once, enforces confidentiality by restricting who can reach classified data in the first place.

Encryption protects that data both in transit, as it moves across a network, and at rest, while it sits stored somewhere, closing the exact gap that failed in the Greater Manchester Police case.

Backup and recovery preserves availability, ensuring that even if something goes wrong, ransomware, hardware failure, human error, the data survives and operations can resume. Cyber Security Solutions Ltd frequently finds organizations have some of these pieces in place but never mapped against each other, meaning a business might have strong encryption while access control quietly went unreviewed for years, exactly the kind of gap that only becomes obvious after an incident forces the question.

Conclusion

The components of data security only matter once you can see how they connect, and the Greater Manchester Police case shows exactly what happens when they don’t. Know your goals, choose mechanisms that genuinely serve them, and check whether your own setup covers every piece or just the ones that were easiest to buy. If you want help mapping your own controls against these components properly, Cyber Security Solutions Ltd can walk through it with you.