Jim West brings expanded security framework to ISC2 Security Congress 2026

Cybersecurity leader Jim West presented his talk “Beyond the CIA Triad” on Oct. 26 at ISC2 Security Congress 2026 in Aurora, Colorado. The session argued that the classic confidentiality, integrity and availability model is too narrow for modern cyber risk and introduced a nine-point framework for assessing mission impact and security priorities.

Why it matters: - Jim West’s framework pushes cybersecurity teams to evaluate risk beyond the familiar confidentiality, integrity and availability model. - The approach is aimed at helping leaders better connect security decisions to mission outcomes, audit findings and acceptable exposure. - For auditors and risk professionals, the model offers a clearer way to explain why certain findings matter and how they should be prioritized.

What happened: - Jim West presented “Beyond the CIA Triad” at ISC2 Security Congress 2026 on Monday, Oct. 26, from 10:10 to 11:10 a.m. MT in Adams D. - The session was part of the conference’s Governance, Risk and Compliance track. - ISC2 Security Congress 2026 ran Oct. 24–28 at the Gaylord Rockies Resort & Convention Center in Aurora, Colorado, with a virtual attendance option. - The session was open to onsite and virtual attendees, livestreamed, recorded and eligible for 1 CPE credit (Group A).

The details: - West’s Nine-Point Core Security Principles Star expands the conversation beyond confidentiality, integrity and availability. - The additional points include non-repudiation, authenticity, authorized use, possession, privacy and utility. - The model is intended to help security leaders, auditors, assessors, engineers and executives visualize risk and map weaknesses to business impact. - West has delivered “Beyond the CIA Triad” since 2016. - West said organizations have tried to plan security strategy through a three-point lens in a nine-point world, which creates blind spots that can lead to breaches, audit failures, mission disruption, privacy exposure and leadership surprises. - West said the session gives executives, auditors, risk managers and cyber teams a more complete way to see exposure and identify which risks must be addressed before they become consequences. - West also described risk as a continuous negotiation between leadership priorities, mission requirements, control effectiveness, audit findings, operational realities and acceptable exposure. - The presentation showed how the Nine-Point Star can be used to visualize risk appetite, separate nice-to-have controls from mission-critical needs, and make defense-in-depth recommendations more precise, defensible and understandable. - A weak firewall configuration can represent not only a confidentiality issue but also an integrity and configuration management issue. - That distinction can affect how organizations prioritize remediation, justify resources and brief senior leadership.

Between the lines: - West is positioning security communication as a governance problem, not just a technical one. - The message reflects a broader industry shift toward frameworks that tie cyber controls to business risk, mission assurance and executive decision-making. - West’s background spans more than 35 years in IT and cybersecurity, along with hundreds of certifications and training programs and thousands of continuing education hours. - That mix of governance, risk management, architecture, systems engineering, mission assurance, privacy and cyber defense helps explain why the talk has remained a recurring draw.

What's next: - West’s core message is that organizations need a richer model to define, measure and communicate security risk. - The talk’s framing suggests future risk discussions will keep moving toward more granular, business-aligned assessments. - ISC2 Security Congress attendees who joined the session could use the framework to reassess how they describe exposures and defend remediation priorities.

The bottom line: - West’s core argument is simple: organizations cannot protect what they cannot properly describe, and the CIA Triad alone is no longer enough for today’s threat landscape.