For decades, cybersecurity strategy has leaned on a three-legged stool. At the ISC2 Security Congress 2026 in Colorado this week, one veteran leader argued that stool is now too wobbly to support modern defense operations.
Jim West, an award-winning cybersecurity leader, educator, and author, took the stage to present his widely requested talk, “Beyond the CIA Triad,” challenging the industry’s long-held reliance on Confidentiality, Integrity, and Availability as the sole pillars of risk management.
West on stage at the ISC2 2026 Security Congress
Also worth a look: B2i Digital-backed AltsOps 2026 targets fund ops, due diligence in NYC and Veteran-owned knowledge management firm earns elite government contracting certification.
West’s Nine-Point Core Security Principles Star expands the conversation beyond confidentiality, integrity, and availability.
The event, held October 24–28 at the Gaylord Rockies Resort & Convention Center in Aurora, Colorado, with a virtual attendance option, is ISC2’s flagship global gathering. It draws thousands of practitioners, executives, researchers, and educators from across the globe, placing West’s message before one of the profession’s most influential audiences.
West delivered his session on Monday, October 26, from 10:10 to 11:10 AM MT in Adams D, as part of the Governance, Risk and Compliance (GRC) track. The livestreamed and recorded presentation was open to both onsite and virtual attendees, offering 1 CPE credit (Group A).
At the heart of the talk is West’s argument that the traditional CIA Triad, while still essential, is no longer sufficient for mapping today’s complex cyber threat landscape. Since 2016, he has been refining his “Beyond the CIA Triad” presentation to help audiences evaluate risk more comprehensively and align security strategy with actual mission outcomes.
West’s proposed solution is the Nine-Point Core Security Principles Star. This model extends the conversation beyond the classic three pillars to include non-repudiation, authenticity, authorized use, possession, privacy, and utility. The framework is designed to give security leaders, auditors, and executives a clearer visualization of risk, mapping weaknesses directly to business impact and clarifying which risks are acceptable, which require mitigation, and which could threaten the core mission.
“For too long, organizations have tried to plan security strategy through a three-point lens in a nine-point world,” West said. “That creates blind spots, and blind spots become breaches, audit failures, mission disruption, privacy exposure, and leadership surprises. The CIA Triad still matters, but by itself it leaves defenders fighting modern threats with an incomplete map. ‘Beyond the CIA Triad’ gives executives, auditors, risk managers, and cyber teams a more complete way to see what is truly at stake, where the exposure really lives, and which risks must be addressed before they become consequences.”
The presentation reframed risk as a continuous negotiation between leadership priorities, mission requirements, control effectiveness, audit findings, operational realities, and acceptable exposure. West demonstrated how the Nine-Point Star can help organizations visualize risk appetite, separate “nice-to-have” controls from mission-critical needs, and make defense-in-depth recommendations more precise and defensible.
For auditors and risk professionals, the model offers a practical lens for explaining why findings matter. A weak firewall configuration, West noted, may not solely be a confidentiality issue; it could also represent an integrity or configuration management problem. This distinction shifts how organizations prioritize remediation, justify resources, and brief senior leadership.
West brings over 35 years of IT and cybersecurity experience, hundreds of certifications, and thousands of continuing education hours to his work. His ability to synthesize governance, risk management, security architecture, and practical cyber defense into a single communication model has made this presentation one of his most enduring and requested.
The core message to ISC2 attendees was direct: organizations cannot protect what they cannot properly describe, and they cannot govern risk effectively with a model too narrow for today’s threat landscape.
Why it matters: As cyber threats grow more sophisticated and interconnected, the frameworks used to explain and manage risk must evolve in parallel. West’s push to expand the industry’s foundational vocabulary suggests that a more nuanced approach could be key to closing the gaps that lead to major breaches and audit failures.
Media Contact:
Michelle Kaldenberg
Michelle@refreshnrestart.com
Michelle Kaldenberg
Refresh n’ Restart
+1 832-303-4593
Visit us on social media:
LinkedIn
