Section 11.1: Security Principles: CIA Triad & Privacy

DAMA Certified Data Management Professional CDMP

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Exam Overview & DMBoK Framework

1.1 CDMP Exam Details & Strategy 1.2 The DMBoK Framework 1.3 Data Management Organization & Roles

2 Chapter 2: Data Governance (Part A)

2.1 Data Governance Principles & Drivers 2.2 Operating Models & Structures 2.3 Policies, Standards, and Procedures

3 Chapter 2: Data Governance (Part B)

2.4 Data Stewardship 2.5 Governance Metrics & Implementation

4 Chapter 3: Data Modeling and Design (Part A)

Section 3.1: Conceptual, Logical, and Physical Models Section 3.2: ERD Notations & Relational Modeling Section 3.3: Normalization

5 Chapter 3: Data Modeling and Design (Part B)

3.4 Dimensional Modeling 3.5 Naming Standards & Modeling Best Practices

6 Chapter 4: Data Quality (Part A)

Section 4.1: Data Quality Dimensions Section 4.2: Data Quality Policy & Rules Section 4.3: DMAIC & DQ Improvement Lifecycle

7 Chapter 4: Data Quality (Part B)

4.4 Root-Cause Analysis & Remediation 4.5 DQ Metrics, Tools, and Reporting

8 Chapter 5: Metadata Management (Part A)

5.1 Business, Technical, and Operational Metadata 5.2 Metadata Lineage & Impact Analysis 5.3 Repository Architectures

9 Chapter 5: Metadata Management (Part B)

5.4 Standards and Semantics 5.5 Metadata Governance & Integration

10 Chapter 6: Master and Reference Data Management

6.1 Master vs Reference Data 6.2 MDM Repository Architectures 6.3 Match-Merge & Identity Resolution 6.4 Reference Data Governance & Standards

11 Chapter 7: Data Warehousing and Business Intelligence

7.1 DW Architectures: Inmon vs Kimball 7.2 Data Warehousing Storage & Load Patterns 7.3 BI Delivery & OLAP 7.4 Data Marts & Enterprise Data Warehouses

12 Chapter 8: Data Architecture

8.1 Enterprise Data Architecture & Zachman Framework 8.2 Data Flow Diagrams & Value Chains 8.3 Architecture Frameworks & Standards

13 Chapter 9: Document and Content Management

9.1 Records Management & ECM 9.2 Retention, Disposal, and E-Discovery 9.3 ARMA GARP Principles & Taxonomies

14 Chapter 10: Data Integration and Interoperability

Section 10.1: Integration Patterns & Technologies Section 10.2: Replication & Virtualization Section 10.3: Canonical Models & Integration Standards

15 Chapter 11: Data Security

Section 11.1: Security Principles: CIA Triad & Privacy Section 11.2: Access Control & Encryption Section 11.3: Security Regulations & Standards

16 Chapter 12: Data Storage and Operations

Section 12.1: Database Technologies & DBA Roles Section 12.2: Backup, Recovery, and High Availability Section 12.3: Performance Tuning & Operations

17 Chapter 13: Big Data and Data Science

13.1 Big Data V's & Technologies

18 Chapter 14: Data Ethics

14.1 DMBoK Data Ethics Framework

19 Chapter 15: Data Management Process and Maturity

15.1 Maturity Assessment Frameworks

Section 11.1: Security Principles: CIA Triad & Privacy

Key Takeaways Explain This Topic AI

The Confidentiality, Integrity, and Availability (CIA) Triad represents the foundational pillars of information security, requiring a balance between protecting access and ensuring usability.

Privacy by Design (PbD) consists of 7 foundational principles, advocating that privacy must be the default setting and embedded directly into the systems lifecycle rather than added retroactively.

Data classification categorizes data based on sensitivity and risk, where Business Data Owners define classification levels and Data Custodians implement technical controls.

The four standard data classification levels are Public, Internal Use Only, Confidential, and Secret.

Last updated: July 2026

Introduction to Data Security

In the context of the Data Management Body of Knowledge (DMBoK2) , Data Security is defined as the planning, development, execution, and supervision of security policies and procedures to ensure proper authentication, authorization, access, and auditing of data and information assets. Data is an enterprise asset, and like any valuable asset, it must be protected from unauthorized access, loss, alteration, or destruction. Security is not a standalone IT project; rather, it is a foundational component of Data Governance (DG) and overall business risk management. Effective data security ensures compliance with legal and regulatory mandates, safeguards reputation, and enables the trusted sharing of information.

The CIA Triad

The core foundation of information security is the Confidentiality, Integrity, and Availability (CIA) Triad . Every security control, policy, or mechanism is designed to address one or more of these three pillars:

Confidentiality

Confidentiality ensures that sensitive data is accessed only by authorized users and processes. It prevents unauthorized disclosure, whether intentional (such as data theft or espionage) or accidental (such as emailing sensitive documents to the wrong recipient).

Core Controls : Confidentiality is achieved through authentication mechanisms (confirming identity), authorization controls (restricting privileges), and robust encryption methods (making the data unreadable to interceptors).

Data Security Role : Data stewards and owners define who should have access, while security administrators enforce these rules using access control tools.

Integrity

Integrity guarantees that data remains accurate, complete, and trustworthy throughout its entire lifecycle. It ensures that data cannot be altered, deleted, or tampered with by unauthorized parties or processes, and that any authorized modifications are fully auditable.

Core Controls : Integrity checks include cryptographic hashing (generating a unique digital fingerprint of the data), digital signatures, database transaction logs, and change audit trails.

DAMA Relevance : Data integrity is closely linked to Data Quality . If security controls fail and unauthorized modifications occur, the quality and credibility of the enterprise data asset are compromised.

Availability

Availability ensures that data and system resources are accessible to authorized users when needed to support business operations. High security controls that restrict access must not render data unusable or inaccessible.

Core Controls : Ensuring availability requires infrastructure resilience, redundant systems, high availability (HA) clustering, database backups, and Disaster Recovery (DR) planning.

The CIA Balance : Security is a balancing act. Excessive confidentiality controls (such as multi-factor authentication or network isolation) can sometimes introduce friction that reduces data availability, slowing business operations. Security architects must balance these three forces based on business risk tolerance.

Privacy by Design (PbD)

Data privacy is distinct from data security, though they are heavily interdependent. While security focuses on protecting data from unauthorized access, privacy focuses on the appropriate and lawful collection, use, and disposal of personal data. Privacy by Design (PbD) is a globally recognized framework developed by Ann Cavoukian in the 1990s, asserting that privacy must be integrated into IT systems, business processes, and physical infrastructure from the very beginning of the design phase.

The PbD framework is built upon seven foundational principles:

Proactive not Reactive; Preventative not Remedial : Anticipate and prevent privacy-invasive events before they occur, rather than fixing them after the fact.

Privacy as the Default Setting : Personal data must be automatically protected in any system or business practice. No action is required by the individual to protect their privacy.

Privacy Embedded into Design : Privacy is an essential component of the core architecture of IT systems and business practices, not an add-on or afterthought.

Full Functionality — Positive-Sum, not Zero-Sum : Avoid trade-offs (e.g., security vs. privacy). All requirements should be satisfied in a win-win manner.

End-to-End Security — Full Lifecycle Protection : Secure data collection, storage, use, and destruction. Robust security measures must ensure that all data is safeguarded throughout its entire lifecycle.

Visibility and Transparency — Keep it Open : All stakeholders (users, partners, regulators) must have clear visibility into how data is processed, verified, and protected.

Respect for User Privacy — Keep it User-Centric : Keep the interests of the individual uppermost by offering strong privacy defaults, detailed notices, and user-friendly options.

Data Classification Levels

To protect data cost-effectively, organizations must categorize their data assets based on sensitivity and risk. Data Classification is the process of labeling data according to its risk level and the potential impact on the organization if it is disclosed, altered, or destroyed.

Classification Ownership and Enforcement

The Data Owner (typically a business executive or trustee) is responsible for determining the classification of a data asset. The Data Custodian (IT or database administrator) is responsible for implementing the technical safeguards corresponding to that classification level.

Most enterprises employ a four-level data classification schema:

Classification Level Sensitivity Typical Data Types Implemented Security Controls

Public Low / None Marketing materials, public directories, press releases Minimal controls; encryption not required; public read access.

Internal Use Only Moderate Corporate emails, standard policies, internal directories Access restricted to employees; standard authentication required.

Confidential / Restricted High Customer database records, proprietary code, vendor agreements Encryption at rest and in transit; Role-Based Access Control; audit logs.

Secret / Highly Confidential Critical Trade secrets, raw cardholder data (PCI), health records (HIPAA) Multi-factor authentication; strict access logs; physical security; tokenization.

Exam Trap: Owner vs. Custodian

A frequent CDMP exam question asks who is responsible for classifying data. Remember that the Data Owner defines the classification and policies, while the Data Custodian or security administrator implements and enforces the technical controls. IT does not own or classify the business data.