Cybersecurity Leader Jim West Presents “Beyond the CIA Triad” at ISC2 Security Congress 2026 in Colorado - EIN Presswire

Jim West, a veteran cybersecurity leader, delivered a presentation titled “Beyond the CIA Triad” at the ISC2 Security Congress 2026 in Aurora, Colorado. The event, held at the Gaylord Rockies Resort & Convention Center from October 24 to 28, 2026, is a flagship global gathering for cybersecurity professionals. West’s session, which took place on Monday, October 26, from 10:10 to 11:10 AM MT, was part of the conference’s Governance, Risk and Compliance track and offered 1 CPE credit to attendees.

West’s address challenged one of the most enduring foundations of information security: the Confidentiality, Integrity, and Availability (CIA) Triad. While the model remains a standard reference point, West argues that the complexity of modern cyber risk has outgrown a three-part framework. He contends that organizations attempting to plan security strategy through this limited lens are operating with blind spots that can lead to breaches and operational failures.

At the core of West’s presentation is his Nine-Point Core Security Principles Star. This model expands the conversation beyond the traditional triad to include non-repudiation, authenticity, authorized use, possession, privacy, and utility. The framework provides security leaders, auditors, and executives with a more comprehensive way to visualize risk and map weaknesses to their specific business impact.

West demonstrated how the Nine-Point Star can be used to visualize an organization’s risk appetite. The model helps distinguish between “nice-to-have” controls and mission-critical needs, allowing for more precise and defensible recommendations for defense-in-depth strategies. For auditors and risk professionals, the framework offers a practical method to explain why specific findings matter, moving beyond generic assessments.

West’s approach reframes risk as a continuous negotiation between leadership priorities, mission requirements, and operational realities. He showed how the model can clarify which risks are acceptable and which require immediate mitigation. His ability to connect multiple governance and security frameworks into a single risk communication model has made “Beyond the CIA Triad” one of his most enduring and requested talks.

With more than 35 years of IT and cybersecurity experience, West brings a wealth of knowledge to the discussion. His presentation blends governance, risk management, security architecture, and practical cyber defense. The session challenged attendees to rethink how they define, measure, and communicate security, emphasizing that organizations cannot protect what they cannot properly describe.

New Risk Framework

West’s Nine-Point Core Security Principles Star introduces six additional principles to the traditional CIA model. These include non-repudiation, which ensures a sender cannot deny sending a message, and authenticity, which verifies the identity of a user or system. The model also incorporates authorized use, possession, privacy, and utility to create a more complete picture of security posture.

The framework provides a visual tool for security teams to identify where their defenses are weakest. By mapping these weaknesses to business impact, organizations can make better decisions about resource allocation. West argues that this clarity is essential for aligning cyber strategy with mission outcomes and for communicating effectively with senior leadership.

West’s presentation offered practical examples of how the model changes risk assessment. A weak firewall configuration, for instance, may not be solely a confidentiality concern but could also represent an integrity or configuration management issue. This distinction allows organizations to prioritize remediation efforts more effectively and to justify resource requests with greater precision.

ISC2 Security Congress

The ISC2 Security Congress is the organization’s flagship global event, bringing together thousands of cybersecurity professionals from across the United States and around the world. The conference provides a platform for expert insight, networking, and professional development. West’s session was accessible to both onsite and virtual attendees, with the presentation being livestreamed and recorded for those unable to attend in person.

West’s message to the audience was direct: organizations cannot govern risk effectively with a model that is too narrow for today’s threat landscape. He urged attendees to adopt a more holistic approach to security that accounts for the full spectrum of potential risks. His presentation concluded with a call to action for the cybersecurity community to rethink how they define and measure security success.