The principle of data security management, which covers the procedures, policies and controls utilized to secure the data of customers and the organization against illicit access or use, is known as :

Question

UnlockIAS · Accepted Answer

Correct — D, Confidentiality. In the CIA triad of information security, confidentiality is exactly the principle that data is seen and used only by those authorised to do so. It is delivered through procedures, policies and controls — access control and authentication, least-privilege / need-to-know rules, encryption and firewalls — aimed at keeping customer and organisational data safe from illicit access or use. The wording of the question ('procedures, policies and controls … against illicit access') is the textbook definition of confidentiality.

Why the other options are wrong — (a) Integrity is about data being accurate, complete and unaltered — protection against tampering, using hashes, checksums, digital signatures and audit logs. It says nothing about who is allowed to see the data.  (b) The strongest trap. Privacy is the individual's right to control their personal data, protected in India by the Digital Personal Data Protection Act, 2023 and by the Puttaswamy judgment (2017) which read privacy into Article 21. Confidentiality is the security control through which an organisation delivers privacy — and it is the security principle the question asks for.  (c) Availability means authorised users can reach the data and systems when needed — assured by backups, redundancy, disaster recovery and DDoS protection. A denial-of-service attack breaks availability, not confidentiality.

Concept: Information security rests on the CIA triad: Confidentiality (who may see the data), Integrity (has the data been altered) and Availability (can authorised users get it when they need it). Attacks map neatly onto the three — a data breach or eavesdropping violates confidentiality, tampering or a man-in-the-middle alteration violates integrity, a DDoS attack or ransomware lockout violates availability. Authentication and non-repudiation are commonly added as supporting objectives.

State PCS 2025 Q10 — Science & Technology PYQ with Answer

State PCS 2025 Q10 — Science & Technology PYQ with Answer