Which confidentiality property states that information must not be disclosed to system entities unless they are authorized to access it?

• A. The property that information is not disclosed to system entities unless they have been authorized to access the information.
• B. The act of holding information in confidence, not to be released to unauthorized individuals.
• C. Ensuring availability of information to authorized users.
• D. Guarding against improper information modification.

Answer: (A)

Confidentiality means information is accessible only to those who are authorized to see it. The statement that information must not be disclosed to system entities unless they are authorized to access it captures that restriction on who can view the data, which is exactly what confidentiality requires.

The other concepts relate to different goals: availability is about ensuring authorized users can access information when needed, and integrity is about preventing unauthorized modification of information. The idea of keeping information in confidence is related but does not as explicitly express the formal access-control requirement that defines confidentiality.