Basics of Information Security
For both regulated and unregulated professionals, information security is not meaningfully separable from professional responsibility.
The handling of client data, whether financial, medical-adjacent, or otherwise confidential, creates obligations that are ethical, legal, and operational. Within information security, these obligations are commonly evaluated through three principles: confidentiality, integrity, and availability. While frequently described as technical concepts, they function more accurately as evaluative criteria for your firm’s practices.
Confidentiality concerns the controlled disclosure of information. In practice, failures of confidentiality in small professional environments are rarely the result of advanced intrusion. They arise from informal access practices, weak identity controls, and systems configured for convenience rather than constraint. Shared credentials, permissive cloud storage, unencrypted communications, and unmanaged devices are typical points of failure. From an enforcement or liability perspective, the absence of malicious intent is immaterial; what matters is whether unauthorized disclosure was a foreseeable outcome of how access was managed.
Integrity addresses whether information remains accurate, complete, and resistant to unauthorized or untracked modification. For professionals, compromised integrity carries risks that extend beyond data security. Decisions, filings, and representations rely on the assumption that records are reliable. Where permissions are excessive, auditability is absent, or systems permit silent alteration, that assumption becomes untenable. In post-incident review, the inability to establish whether records were altered—or when—often proves as damaging as the alteration itself.
Availability reflects the expectation that systems and records will be accessible only when required to meet professional obligations. Ransomware, failed backups, unsupported systems, and poorly planned changes routinely disrupt small practices. Security measures that protect data while neglecting continuity are incomplete. Increasingly, availability is treated as an element of client harm analysis, particularly where service interruption prevents timely action or compliance.
Taken together, confidentiality, integrity, and availability provide a coherent framework for assessing whether safeguards were commensurate with the obligations assumed by the professional. They are routinely used—explicitly or implicitly—to evaluate security decisions after an incident has occurred. Framing security choices in these terms does not guarantee favorable outcomes, but it materially improves defensibility by demonstrating that risks were considered in a structured and recognized manner.
Many practices address these principles incrementally and without formalization. That approach can be sufficient in limited contexts, provided it reflects actual risk and is periodically revisited. As reliance on digital systems increases, or as regulatory exposure grows, informal controls tend to erode faster than they are replaced. At that point, the issue is not sophistication, but whether the practice can plausibly demonstrate that its handling of client information met professional expectations at the time it mattered.