Confidentiality protects information content from unauthorized access while it is stored, transmitted, or processed. It differs from privacy, which concerns control over when, how, and to what extent information is communicated, and from authenticity, which establishes who the parties are. section 2.7.1 section 2.7.3
Confidential content, exposed metadata
Alice uses TLS for an anonymous virtual-health consultation. An eavesdropper cannot read the encrypted content, but can still observe routing information such as Alice’s and the server’s IP addresses and the site’s domain name. The communication is confidential even though its privacy is incomplete. section 2.7.1
Confidentiality depends on more than encryption. Authorization policies determine who may access information, while identity systems, authentication, governance, and reliable policy application help ensure that access is granted only to appropriate parties. Policy-based authorization can enforce thresholds automatically, reduce unnecessary exposure, and route sensitive decisions to human reviewers when required. section 2.7 section 2.7.3 section 2.9
Operationally, confidentiality requires balancing protection with usable access:
- Use TLS to create a confidential communications channel, while checking certificates, domains, and configuration because phishing, expired authorities, misconfiguration, and interception can undermine trust. section 3.2
- Combine privacy, confidentiality, and authenticity controls instead of treating authorization as an isolated yes-or-no decision. section 2.7 section 2.7.3
