DICP: the four information security criteria

DICP is the French acronym for the four information security criteria: Availability, Integrity, Confidentiality and Proof. Assessing the DICP needs of a piece of information or a process means rating on a scale how demanding each of these criteria is. This profile then serves as the basis for risk analysis and the choice of security controls.

The DICP criteria answer a simple question: what would be serious for this information? That it becomes inaccessible, that it is wrong, that it falls into the wrong hands, or that nobody can prove who changed it. The first three criteria are defined by the ISO/IEC 27000 vocabulary standard; the fourth is a widespread French practice.

D for Availability (Disponibilité)

Availability is the property of information or a service being accessible and usable when an authorised person needs it. It is often expressed as a maximum tolerable outage time: a few days for an intranet, less than one hour for an emergency dispatch system. This criterion ties in directly with business continuity.

I for Integrity

Integrity guarantees that information is accurate and complete, and has not been changed without authorisation, whether maliciously or by mistake. A transfer whose bank details have been altered, a modified dosage in a medical record or a changed price on an online shop are all breaches of integrity.

C for Confidentiality

Confidentiality ensures that information is only accessible to authorised people, entities or processes. It is broken down into distribution levels: public, internal, restricted, highly restricted. It is the most intuitive criterion, but rarely the only one at stake.

P for Proof (or traceability)

Proof is the ability to establish who did what and when, and to demonstrate it, including to a third party. It covers traceability (logs), accountability (linking an action to a person) and non-repudiation (preventing someone from denying an action). The term DICT is also used, with T for traceability; “proof” is broader, because a trace that is neither protected nor timestamped proves very little.

These acronyms refer to the same family of criteria, with broader or narrower coverage. The CIA triad (Confidentiality, Integrity, Availability) is the international reference, used by ISO and by the US NIST in its FIPS 199 standard. The GDPR refers to it too: its Article 32 requires the ability to ensure “the ongoing confidentiality, integrity, availability and resilience” of processing systems.

A DICP need only makes sense if it is rated on a common scale, defined before the assessment and identical across the organisation. ANSSI's EBIOS Risk Manager guide points out that the goal is not to find an absolute value but to position pieces of information relative to one another. Most organisations use four levels, which avoids the temptation of a “medium” in the middle. Here is an example scale, to be adapted to your context.

Take the payroll data of a 300-employee company. The HR manager, who owns the information, answers four questions with the CISO, reasoning about the consequences of a breach rather than about the protections already in place.

• Availability: 2. A two-day outage can be caught up, except the day before payroll, flagged as a critical period.
• Integrity: 4. A changed bank detail diverts a salary; a wrong amount has social and legal consequences.
• Confidentiality: 3. Salaries and social security numbers are personal data restricted to the HR department and the payroll provider.
• Proof: 3. Every change to bank details or salaries must be attributable to a person, in case of fraud or inspection.

The resulting profile, D2 · I4 · C3 · P3, immediately shows where to focus: on integrity checks and on tracing changes to bank details, far more than on high availability. Try the assessor below with three example assets, then adjust the levels to see the typical controls change.

DICP does not measure a risk: it expresses a need. Risk appears when that need is combined with a threat and a likelihood. This is why the DICP assessment comes at the start of any risk analysis.

• In EBIOS Risk Manager, workshop 1 identifies business assets (essential information and processes) and ranks them according to their security needs, such as availability, integrity or confidentiality. These needs guide the severity of feared events. Our risk analysis module supports the method.
• With ISO 27005, DICP needs feed the consequence criteria used when analysing and evaluating risks.
• For a security accreditation, the system's DICP profile justifies the level of the selected controls to the accrediting authority.

One decisive point of method: you assess the DICP of business assets (payroll, the patient record), and the supporting assets that carry them (server, application, supplier) inherit it. The result can then be shown in a risk matrix.

• Rating everything at the maximum. If everything is critical, nothing is: the security budget can no longer be prioritised.
• Assessing the server rather than the information. The need comes from business use, not from technology.
• Assessing without the business. The CISO facilitates, but the information owner knows the real consequences and validates.
• Confusing need with existing protection. “It is already encrypted, so C1” is a misreading: the need remains C3 even if the control is in place.
• Never reviewing. A new regulation, such as the French obligation for certified health data hosting, or a new use can change a need.

In Phinasoft, business assets and their security needs are entered in the risk analysis itself, with your own scales, and linked to scenarios and to the action plan. The risk analysis module invites business contributors into the analysis and guides them step by step. To see it applied to your own assets, you can request a demo.