Which process is responsible for the availability, confidentiality and integrity of data?

Service catalogue management maintains records of live IT services and their details, but has no responsibility for data security properties.

Service asset and configuration management tracks CIs and their relationships but does not govern security attributes like confidentiality or integrity.

Change management controls the lifecycle of changes to reduce risk, but it does not own or enforce the CIA triad for data.

Information security management is the ITIL process explicitly chartered to protect the confidentiality, integrity, and availability (CIA) of an organization's information assets. It defines security policies, manages security controls, and ensures data is accessible only to authorized parties while remaining accurate and available when needed.