The most common model that's used to understand a threat's impact on information security is the confidentiality, integrity, availability (CIA) triad. In this section, you will learn how to explain these three types of consequence that result from a threat. The CIA triad is very common across the whole industry.
In CVSS v3.0, these three components are referred to collectively as impact metrics. Each is scored independently as either high, low, or none to give the user an overview of how severe the effects of the threat would be if they were realized. If multiple components are vulnerable to the threat, the scores are taken from the component which suffers the most severe consequences.
