We have to, of course, define what we mean by confidentiality. Now, this seems an obvious thing, but we have already defined that confidentiality means confidentiality for non-individually identifiable information and confidentiality for what we term private information or sensitive information about persons. So we need to be very specific about what we mean and it needs to be contextually specific. It could be about trade secrets. It could be about the privacy information that is individually identifiable, such as PII or PHI. And then we have certain special categories that would include things like national security or critical infrastructure. And if those apply, we need to be equally certain and clear about our definitions for those.

Likewise, we need to define what we mean by integrity. Integrity is a somewhat nondescript or difficult-to-describe characteristic. We simply know that the data is or must be kept trustworthy by how it's manipulated by authorized people and that no unauthorized person can have any access to it whatever. So we need to come up with prevention and detection methods so that contamination and corruption are hopefully avoided at creation or data entry, or the receipt, if we are on the receiving end of it, or methods to detect it, should it arise at some point after we've received it.

The end of this, of course, is to ensure always that the data is as authentic and as trustworthy as we need it to be for the particular process. We need to define our availability and we need to know what requirements we have in this area to ensure that the information is always accessible, and, to the extent we can, ensure that it's timely for all authorized users and uses.