Breaches fall into three types, and one incident can be more than one. Confidentiality is about disclosure, integrity about changes and availability about loss of access.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Disclosure to the wrong person is a confidentiality breach
- Unauthorised changes are an integrity breach
- Ransomware is often all three
Next steps
Naming the type helps you assess the risk. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.