to authorized users. Often authenticity is mentioned as a fourth fundamental requirement. Otherwise it has been regarded as part of integrity. Authenticity means that we know with whom we are communicating: we authenticate ourselves and form an integrity-protected secure session between each other. For a company, the needs might be somewhat developed: Which systems are most critical to the business? What information needs protection? In what way should the systems and information be protected? Integrity Integrity means that information being transported or stored cannot be manipulated or modified. This includes altering, changing status, deleting and creating. As an example, an e-mail could be manipulated while it is queued on a mail-server. One way of protection is using electronic signatures. Integrity could be defined as 'the assurance of accuracy, completeness and performance according to specifications'. There are three aspects of integrity: authorized actions, separation and protection of resources, and finally error detection and correction. Sometimes another two requirements are included: Authentication: identity should be proved, for example by means of certificates. Authentication addresses the simple question 'Who are you?' Non-repudiation: What is sent/received is sent/received and cannot be denied. Security Confidentiality Confidentiality means that information being transported or stored is prevented from being revealed to unauthorized parties. Differentiation is necessary for access to different sorts of information. The type of access could be reading, viewing, printing or even just knowing the existence of an object. Confidentiality is sometimes called secrecy, privacy or prevention of intrusion. The most common confidentiality measure is encrypting the information. Confidentiality could be defined as 'the ability to avoid disclosing information to anyone who is not authorized to use it'. Availability Availability has turned out to be a complex term. In general it means that assets are accessible