Stands for confidentiality, integrity, and availability. It’s used to help better understand the vendor’s approach to security and their overall posture on the CIA elements.