The degree to which a product or system ensures that data are accessible only to those authorized to have access.