This column features a trio of triads. First are cybersecurity goals, which will help you understand and prioritize cybersecurity to improve your law firm or organization. These three goals will help you achieve an important fourth goal, which can even improve your mental state.

Knowing the next two triads helps you intelligently discuss cybersecurity principles with your technical and cybersecurity providers and experts, and to better understand cybersecurity laws and frameworks. Consider these three goals of cybersecurity for your organization: (1) Protect from cybercrime or other serious mishaps, (2) Comply with legal requirements, and (3) Fulfill the mission, including by improving efficiency and the management of information systems.

We introduced these goals in an earlier column (see, "Maintain and improve the cybersecurity program of your firm or organization", Reuters Legal News, Feb 17, 2026,) and will discuss further in a moment.

The Venn diagram from that article showed a bubble for each goal with some areas overlapping and others distinct.

Now we can add to that diagram and introduce the fourth goal, peace-of-mind, which encircles all three.

When organizations work honestly and effectively to achieve the three goals, while doing their reasonable best, that provides peace-of-mind. This is not a guarantee of imperviousness or success, but as much assurance and certainty as life and business can provide.

In contrast, when organizations ignore the three goals and neglect to work on their cybersecurity program, no such comfort can be achieved. Leaders are left with nagging worries in the pit of their stomach because important actions remain undone and the chances of damage are heightened.

If they fall victim to cybercrime, they may be accused of being negligent and sloppy, and it will be harder to defend against that claim. Let's briefly consider what each of the three goals entails.

The goal of protect puts focus on preventing the bad things that could happen, including attacks by cybercriminals (data breach, ransomware, email-based frauds and thefts) and also system outages.

Protect is focused on traditional risk analysis; thinking about the harms that could occur, then deciding what to do about them — if anything. Often, this means taking steps to prevent them from happening in the first place, or reducing the damage that might result.

Comply focuses on the legal and professional duties of cybersecurity, and every organization has legal requirements there.

At the most basic level, think of simple negligence, and how organizations should expend reasonable and diligent efforts to achieve reasonable cybersecurity.

No firm leader would ever say, "We are content to take the negligent and sloppy approach to cybersecurity." Faced with such a claim by an outsider, they would defend and contest it, and attempt to show facts to demonstrate their cybersecurity was reasonable.

Don't wait for a cybercrime or such a claim to start thinking about your cybersecurity, take the steps now to ensure you can defend against such a claim later. By doing so, you will also reduce the chance of ever being subjected to it.

Attorneys have specific professional duties relating to cybersecurity and to protect client confidences and funds. Attorneys are lucrative cybercrime targets because they are involved directly and indirectly in a multitude of financial transactions and payments. Cybercriminals work to breach email accounts and redirect the transfers of funds to steal those payments.

All states impose legal requirements for data breach notification, and many states have cybersecurity requirements. Other laws and regulations may apply, depending on the sector.

In sum, every attorney, law firm, and organization has legal requirements relating to cybersecurity, and attorneys have professional ethical duties. Compliance with those rules protects and gives peace of mind.

Focus upon the goal of mission allows us to examine all the things that can go right when law firms, lawyers, and others properly manage their information assets. They can efficiently access email, contacts, and documents, spending more time doing work, life, and pleasure, and less time struggling with (or cursing at) IT systems.

In many ways mission comes first because no organization exists just to comply with rules, nor just to protect from cybercrimes. Law firms exist to serve clients (often this means bringing in revenue too) and every organization has a mission.

This "CIA" triad is a cybersecurity basic principle that is less intuitive but good to know since cybersecurity laws, frameworks, and professionals mention it. If you hadn't heard about the CIA triad before, now you can nod knowingly when you read or hear it next. The three objectives of cybersecurity are:

•Confidentiality•Integrity, and•Availability. Confidentiality means keeping unauthorized users from accessing the systems or data. Passwords, two-factor authentication, and hundreds of other measures help keep our data and systems confidential and safe. When a cybercriminal breaks into a law firm's email systems and documents, confidentiality has been violated.

Integrity means that only authorized users can make changes in your system. When a cybercriminal uses a lawyer's email systems to send an email which misdirects a bank wire, integrity has been violated.

Availability means that authorized users can access their systems and data when needed. Ransomware and other cybercrimes can remove the availability of data and systems.

In order to achieve the three objectives or three goals, organizations (and individuals) can apply appropriate cybersecurity controls, which are also known as cybersecurity safeguards. Think of these as more discrete tasks or steps along the way to a broader objective. Cybersecurity laws and frameworks incorporate this concept as well.

There are different ways to categorize these controls but an important way is with the initialism of "PAT," which stands for•Physical•Administrative, and•Technical.

Physical controls restrict physical access in one way or another. Locking a door, a receptionist who controls access, securing your phone or purse while in a public place are all examples of physical controls.

Administrative controls include rules, policies, procedures, and training. Your organization should have a cybersecurity policy and conduct cybersecurity training.

Technical controls are electronic protections, such as a firewall, antivirus, or monitoring software.

These three control types illustrate that cybersecurity is not just about the technical aspects, but many others too, including those that are in the lawyer's wheelhouse. A trio of triads.

We begin with the one that is less well known but is intuitive and simple to help us understand why we do cybersecurity and what we can achieve. Do these sufficiently and we get the fourth goal of peace-of-mind, knowing we are doing our reasonable, diligent best with cybersecurity.

Two are well-known and good to know, even though less intuitive to the casual observer. Cybersecurity professionals know them well and you will see their pattern imprinted upon many cybersecurity laws and best practices.

None of these triads replace the broader process of building and improving your organization's cybersecurity program, as we covered in prior articles. They do help with continual improvement and refined understanding of your program. Fight the tendency for fear, uncertainty and doubt.

Remember that for each step of improvement that you take with your organization's cybersecurity, you travel further away from the nagging worries of tasks and duties left undone, and closer towards your peace of mind with reasonable cybersecurity or better.