ISC2 Beginner

CC

ISC2 Certified in Cybersecurity

The ISC2 Certified in Cybersecurity (CC) is an entry-level cybersecurity certification that validates foundational knowledge and skills required to begin a career in cybersecurity. Designed for individuals new to the field or those transitioning from other IT disciplines, the CC certification demonstrates a commitment to the cybersecurity profession and provides a solid understanding of core security concepts and best practices.

This certification covers five domains: Security Principles (26%), Business Continuity, Disaster Recovery and Incident Response Concepts (10%), Access Controls Concepts (22%), Network Security (24%), and Security Operations (18%). Candidates will learn fundamental security principles including CIA triad, governance, risk management, compliance, access control models, network security technologies, and incident response procedures.

The CC certification is ideal for recent graduates, career changers, or IT professionals looking to pivot into cybersecurity. It serves as an excellent foundation for advanced ISC2 certifications like SSCP and CISSP. ISC2 offers free training materials for the CC certification, making it accessible to anyone interested in starting their cybersecurity journey.

Updated Jan 2024 Cybersecurity

100

Questions

Practice Tests

70%

Pass Score

Views

Total Attempts

Avg. Score

Pass Rate

Discussions

Practice Tests Flash Cards Exam Topics Cheat Sheet

€5.00

CC Practice Exam 1

Comprehensive 50-question practice exam covering all five ISC2 CC domains: Security Principles, Business Continuity Disaster Recovery and Incident Response, Access Controls Concepts, Network Security, and Security Operations.

50 Q 60 minutes 70%

Test Drive

€5.00

CC Practice Exam 2

50 Q 60 minutes 70%

Test Drive

€5.00

CC Practice Exam 3

50 Q 60 minutes 70%

Test Drive

€5.00

CC Practice Exam 4

50 Q 60 minutes 70%

Test Drive

€5.00

CC Practice Exam 5

50 Q 60 minutes 70%

Test Drive

€5.00

CC Practice Exam 6

50 Q 60 minutes 70%

Test Drive

Unlock All Content for CC

6 Practice Test(s) + Flash Cards — 3 months access

€39.99 €26.99 Save 30%

or included with Monthly subscription / Content Bundle

CC Cheat Sheet

Quick reference guide - 7 sections

Free Access

ISC2 Certified in Cybersecurity (CC)

The ISC2 Certified in Cybersecurity (CC) is an entry-level cybersecurity certification designed for individuals beginning their career in information security. No prior work experience or prerequisites are required, making it the ideal starting point for those looking to break into the cybersecurity field. The CC demonstrates foundational knowledge of security principles, concepts, and best practices. It covers five domains that align with the foundational knowledge expected of a junior cybersecurity analyst or security operations team member. ISC2 periodically offers free exam vouchers and training to make this certification accessible to a wide audience.

Exam Details

Exam Code	CC
Duration	120 minutes
Number of Questions	100 multiple-choice questions
Passing Score	700 / 1000
Cost	$199 USD (free vouchers often available through ISC2)
Experience Required	None - no prerequisites
Question Types	Multiple choice (single and multiple select)
Testing Options	Pearson VUE testing center or online proctored
Certification Maintenance	15 CPE credits per year (45 per 3-year cycle), $50 annual maintenance fee

Domain Weight Breakdown

Domain	Weight
Domain 1: Security Principles	26%
Domain 2: Business Continuity, Disaster Recovery & Incident Response	10%
Domain 3: Access Controls Concepts	22%
Domain 4: Network Security	24%
Domain 5: Security Operations	18%

ISC2 Certification Path

The CC is the entry-level certification in the ISC2 portfolio. After earning the CC, candidates can progress to the SSCP (Systems Security Certified Practitioner) for operational IT security roles, or work toward the CISSP (Certified Information Systems Security Professional) for senior security management positions. The CC builds the foundational vocabulary and concepts that the SSCP and CISSP expand upon significantly. All ISC2 certifications require adherence to the ISC2 Code of Ethics, which prioritizes protecting society, acting honorably, providing diligent service, and advancing the profession.

Tip: The CC exam tests foundational understanding rather than deep technical knowledge. Focus on understanding the WHY behind security concepts rather than memorizing technical details. Many questions test your ability to apply basic security principles to real-world scenarios.

Domain 1: Security Principles (26%)

This is the largest domain and establishes the foundational security concepts that all other domains build upon. It covers the CIA triad, authentication and authorization concepts, security governance principles, risk management basics, security controls, the ISC2 Code of Ethics, and the legal and regulatory environment. Expect roughly one quarter of all exam questions to come from this domain.

The CIA Triad

Principle	Definition	Examples
Confidentiality	Ensuring only authorized individuals can access information	Encryption, access controls, data masking, privacy screens
Integrity	Ensuring data remains accurate, complete, and unaltered by unauthorized changes	Hashing, digital signatures, checksums, input validation, version control
Availability	Ensuring systems and data are accessible when needed	Redundancy, backups, load balancing, fault tolerance, UPS

Additional concepts: Non-repudiation provides proof that an action was performed by a specific individual (digital signatures, audit logs). Authentication verifies who you are. Authorization determines what you can do. Accountability links actions to specific users through logging.

Authentication Factors

Factor Type	Category	Examples
Something You Know	Knowledge	Password, PIN, security question answer
Something You Have	Possession	Smart card, security token, mobile phone with authenticator app
Something You Are	Biometric	Fingerprint, facial recognition, iris scan, voice recognition

MFA (Multi-Factor Authentication): Requires two or more different factor types. Password + PIN is NOT MFA because both are knowledge factors. Password + fingerprint IS MFA because it combines knowledge and biometrics. SFA: Single-Factor Authentication uses only one factor type (e.g., password only).

Security Governance Concepts

Policies: High-level statements of management intent and direction. Mandatory for all employees. Example: "All company data must be encrypted at rest."
Standards: Specific mandatory requirements that support policies. Example: "AES-256 must be used for all data-at-rest encryption."
Procedures: Detailed step-by-step instructions for performing a specific task. Example: "How to enable BitLocker encryption on a laptop."
Guidelines: Recommended (not mandatory) best practices. Example: "Users should change passwords every 90 days."
Baselines: Minimum security configurations for systems. Example: "All servers must have firewall enabled and unused ports closed."

Risk Management Basics

Term	Definition
Threat	Something that could cause harm (hacker, natural disaster, malware, insider threat)
Vulnerability	A weakness that can be exploited by a threat (unpatched software, weak password, open port)
Risk	The likelihood of a threat exploiting a vulnerability and the resulting impact (Risk = Threat x Vulnerability x Impact)
Asset	Anything of value to the organization (data, hardware, software, people, reputation)

Risk Response	Description	Example
Avoid	Eliminate the activity that creates the risk	Stop storing credit card numbers
Mitigate	Reduce the likelihood or impact of the risk	Install firewalls, apply patches, train users
Transfer	Shift the risk to a third party	Purchase cyber insurance, outsource to a managed provider
Accept	Acknowledge and document the risk without additional action	Risk is too low to justify the cost of mitigation

Security Controls Categories

Control Type	Purpose	Examples
Preventive	Stop an incident before it occurs	Firewall rules, locks, encryption, security training
Detective	Identify that an incident has occurred or is occurring	IDS, security cameras, log monitoring, audits
Corrective	Fix the issue after an incident has occurred	Patching, restoring from backup, incident response
Deterrent	Discourage potential attackers	Warning banners, security guards, visible cameras
Compensating	Substitute when a primary control is not feasible	Extra monitoring when MFA cannot be implemented

Control implementation types: Administrative (policies, training, procedures), Technical/Logical (firewalls, encryption, access controls), Physical (fences, locks, badges, cameras).

ISC2 Code of Ethics

Canon I: Protect society, the common good, necessary public trust and confidence, and the infrastructure
Canon II: Act honorably, honestly, justly, responsibly, and legally
Canon III: Provide diligent and competent service to principals
Canon IV: Advance and protect the profession

Tip: The canons are listed in priority order. If there is a conflict, protecting society (Canon I) always takes precedence over serving your employer (Canon III). This is a frequently tested concept.

Domain 2: Business Continuity, Disaster Recovery & Incident Response (10%)

This domain covers how organizations prepare for, respond to, and recover from disruptive events. Although it is the smallest domain by weight, the concepts are critical and frequently appear in scenario-based questions. You should understand the differences between business continuity and disaster recovery, the incident response lifecycle, and key recovery metrics.

BCP vs DR

Aspect	Business Continuity (BCP)	Disaster Recovery (DR)
Focus	Keeping the entire business running during a disruption	Restoring IT systems and data after a disaster
Scope	People, processes, technology, and facilities	IT infrastructure and data recovery
Timing	Before, during, and after the event	Primarily after the disaster
Key Activity	Business Impact Analysis (BIA)	System restoration and failover

Business Impact Analysis (BIA): Identifies critical business functions, determines the impact of their loss, and prioritizes recovery. The BIA determines which functions need the most resources and shortest recovery times. It is the foundation for both BCP and DR planning.

Key Recovery Metrics

Metric	Definition	Example
RTO	Recovery Time Objective: Maximum acceptable time to restore a system	Email must be restored within 4 hours
RPO	Recovery Point Objective: Maximum acceptable data loss measured in time	No more than 1 hour of data loss (backup frequency)
MTD	Maximum Tolerable Downtime: Longest time a function can be down before critical damage	Online store cannot be down for more than 24 hours

Disaster Recovery Site Types

Site Type	Description	Recovery Time	Cost
Hot Site	Fully equipped with hardware, software, and current data	Minutes to hours	Most expensive
Warm Site	Has hardware and connectivity but needs data restoration	Hours to days	Moderate
Cold Site	Empty facility with power and network only; no hardware pre-installed	Days to weeks	Least expensive

Incident Response Process

Phase	Activities
1. Preparation	Create IR policies and procedures, build the IR team, set up tools and communication channels, conduct training and drills
2. Detection & Analysis	Monitor for security events, analyze alerts, determine if an incident has occurred, classify severity and scope
3. Containment	Isolate affected systems to prevent spread; short-term containment (disconnect from network) and long-term containment (apply temporary fixes)
4. Eradication	Remove the root cause of the incident (delete malware, close vulnerabilities, remove unauthorized accounts)
5. Recovery	Restore systems to normal operation, verify systems are clean, monitor for recurrence, gradually bring services back online
6. Lessons Learned	Review what happened, what worked, what failed; update procedures and controls; document the incident for future reference

Tip: The lessons learned phase is often overlooked in practice but is critical for improving future response. Always document what happened and update your IR plan accordingly.

Backup Strategies

Backup Type	What It Backs Up	Speed / Storage
Full Backup	All data every time	Slowest to create; fastest to restore; most storage
Incremental Backup	Only data changed since the last backup (any type)	Fastest to create; slowest to restore; least storage
Differential Backup	Only data changed since the last full backup	Moderate speed; moderate restore time; moderate storage

Domain 3: Access Controls Concepts (22%)

This domain covers how organizations control who can access what resources and under what conditions. It includes physical and logical access controls, access control models, and identity management concepts. This is the second-largest domain and is fundamental to all aspects of cybersecurity.

Key Access Control Principles

Least Privilege: Users should have only the minimum access necessary to perform their job functions. No more, no less.
Separation of Duties (SoD): Critical tasks are divided among multiple people so that no single person can complete a sensitive process alone. Prevents fraud and errors.
Need to Know: Even with the proper clearance, access is only granted if the information is required for the person's specific job task.
Defense in Depth: Multiple overlapping layers of security controls. If one layer fails, the next layer provides protection.
Deny by Default: All access is denied unless explicitly granted. This is the safest starting point for any access control system.

Access Control Models

Model	Who Decides	Description	Example
DAC	Resource owner	Owner grants or revokes access at their discretion	File sharing permissions on Windows or Google Drive
MAC	System / Administrator	System enforces access based on security labels and clearances	Military classified systems (Top Secret, Secret, Confidential)
RBAC	Administrator	Access based on job role; users are assigned to roles that have predefined permissions	Active Directory groups, HR role vs Finance role
Rule-Based	System rules	Access determined by predefined rules (time, location, condition)	Firewall ACLs, access only during business hours

Physical Access Controls

Control	Type	Description
Badge / Key Card	Preventive	Electronic card that grants entry to restricted areas; logs entry/exit
Mantrap / Vestibule	Preventive	Two interlocking doors where only one opens at a time; prevents tailgating
Security Guard	Preventive / Detective / Deterrent	Human security presence that can verify identity, detect issues, and deter intruders
CCTV / Cameras	Detective / Deterrent	Video surveillance that records activity and deters unauthorized behavior
Fencing / Bollards	Preventive / Deterrent	Physical barriers preventing unauthorized vehicle and pedestrian access
Biometric Readers	Preventive	Fingerprint, retina, or facial recognition scanners for high-security areas

Logical Access Controls

Control	Description
Passwords	Knowledge-based authentication; should be complex, unique, and stored as salted hashes
Access Control Lists (ACLs)	Lists defining which users or systems have permission to access a specific resource and what actions they can perform
Encryption	Scrambles data so only authorized parties with the correct key can read it; protects confidentiality
Account Lockout	Locks an account after a specified number of failed login attempts; prevents brute-force attacks
Session Timeout	Automatically logs out inactive sessions after a defined period to prevent unauthorized use

Identity Management Lifecycle

Provisioning: Creating a new user account and granting initial access rights when an employee joins
Review / Recertification: Periodically verifying that user access rights are still appropriate for their current role
Modification: Updating access when a user changes roles or responsibilities (role transfer)
Deprovisioning: Disabling or removing access when an employee leaves or no longer needs access; should be immediate for terminations

Tip: Account deprovisioning is one of the most critical and frequently tested concepts. Failing to promptly disable accounts of terminated employees is a major security risk. Always disable (not delete) accounts first to preserve audit trails.

Domain 4: Network Security (24%)

This domain covers the fundamentals of computer networking and how to secure network infrastructure. It includes network architecture, common network threats, firewalls, and secure communication protocols. This is the second-largest domain and requires understanding of basic networking concepts alongside their security implications.

OSI Model Overview

Layer	Name	Function	Security Relevance
7	Application	User-facing services (HTTP, DNS, SMTP)	WAF, input validation, authentication
6	Presentation	Data formatting, encryption, compression	SSL/TLS encryption
5	Session	Session establishment, management, termination	Session management, timeouts
4	Transport	End-to-end communication (TCP/UDP)	TLS, port-based filtering
3	Network	Routing and IP addressing	Firewalls, IPsec, IDS/IPS
2	Data Link	MAC addressing, switching	VLANs, 802.1X, MAC filtering
1	Physical	Physical transmission (cables, signals)	Physical security, cable locks

Network Security Devices

Device	Function	Key Facts
Firewall	Controls traffic between networks based on rules	Packet filtering (Layer 3-4), stateful inspection (tracks connections), application-level (Layer 7)
IDS	Detects suspicious activity and alerts administrators	Passive monitoring only; does not block traffic; signature-based or anomaly-based
IPS	Detects and blocks suspicious activity automatically	Inline (traffic flows through it); can block attacks in real-time
Router	Forwards packets between networks (Layer 3)	Can apply ACLs to filter traffic; connects different networks
Switch	Connects devices on the same network (Layer 2)	Supports VLANs for network segmentation; port security
Proxy Server	Intermediary that filters and caches web requests	Forward proxy (user to internet), reverse proxy (internet to servers)

Network Segmentation Concepts

Concept	Description
DMZ (Demilitarized Zone)	A network segment between the internet and the internal network that hosts public-facing services (web servers, email servers). Provides a buffer zone so attackers who compromise DMZ servers cannot directly access internal resources.
VLAN	Virtual LAN that logically separates devices on the same physical network. Reduces broadcast domains and limits the scope of attacks. Traffic between VLANs requires a router (inter-VLAN routing).
Microsegmentation	Granular segmentation at the workload level (often in cloud/virtual environments). Each application or service gets its own security controls. Core concept of Zero Trust architecture.
Air Gap	Complete physical isolation of a network from all other networks. Used for the most sensitive systems (military, SCADA/ICS). No internet or external connectivity.

Common Network Threats

Threat	Description	Defense
Phishing	Fraudulent messages tricking users into revealing credentials or clicking malicious links	Security awareness training, email filtering, MFA
Malware	Malicious software including viruses, worms, trojans, ransomware, spyware	Antivirus/EDR, patching, user training, application whitelisting
DoS / DDoS	Overwhelming a system with traffic to make it unavailable	Rate limiting, CDN, traffic scrubbing, redundancy
Man-in-the-Middle	Intercepting communication between two parties without their knowledge	Encryption (TLS/HTTPS), certificate validation, VPN
Social Engineering	Manipulating people into divulging information or performing actions	Security awareness training, verification procedures, policies
Insider Threat	Malicious or negligent actions by employees, contractors, or partners	Least privilege, monitoring, background checks, DLP

Secure Protocols

Insecure	Secure Alternative	Why It Matters
HTTP	HTTPS	TLS encrypts web traffic; prevents eavesdropping and tampering
Telnet	SSH	Encrypted remote access replacing plaintext Telnet
FTP	SFTP / FTPS	Encrypted file transfer; FTP sends credentials in plaintext
Unencrypted Wi-Fi	WPA2 / WPA3	Wireless encryption prevents eavesdropping on Wi-Fi networks

VPN (Virtual Private Network)

Purpose: Creates an encrypted tunnel over the internet to securely connect remote users or sites to a private network
Site-to-Site VPN: Connects two entire networks (e.g., branch office to headquarters); always-on tunnel between network devices
Remote Access VPN: Connects individual users to the corporate network from any location; user initiates the connection
Protocols: IPsec (Layer 3, strong encryption), SSL/TLS VPN (Layer 4-7, browser-accessible), WireGuard (modern, lightweight)

Tip: VPNs provide confidentiality for data in transit but do NOT protect data at rest. Always combine VPN usage with encryption at rest and strong access controls at the destination.

Domain 5: Security Operations (18%)

This domain covers the day-to-day activities involved in maintaining a secure environment. It includes data security practices, system hardening, security awareness training, logging and monitoring, and change management. These are the practical operational tasks that security professionals perform regularly.

Data Security Practices

Practice	Description
Encryption	Convert readable data (plaintext) into unreadable format (ciphertext) using an algorithm and key. Symmetric encryption uses one shared key (AES). Asymmetric uses a key pair (RSA).
Hashing	One-way function that produces a fixed-length output (hash) from any input. Used for integrity verification and password storage. Common algorithms: SHA-256, SHA-3. MD5 and SHA-1 are deprecated.
Data Masking	Replacing sensitive data with realistic but fictional values for use in non-production environments (testing, development)
Data at Rest	Data stored on disk; protect with full-disk encryption (BitLocker, FileVault), database encryption (TDE)
Data in Transit	Data moving across a network; protect with TLS/HTTPS, VPN, IPsec
Data in Use	Data being processed in memory; protect with secure enclaves, memory encryption, process isolation

System Hardening

Change default credentials: Always replace factory-set usernames and passwords before deploying any system
Disable unnecessary services: Turn off any services, ports, or features that are not required for the system's function
Apply patches promptly: Install security updates as soon as they are available and tested; prioritize critical patches
Remove unnecessary software: Uninstall applications that are not needed to reduce the attack surface
Enable host-based firewall: Configure the local firewall to allow only necessary inbound and outbound traffic
Apply security baselines: Use industry benchmarks (CIS Benchmarks, DISA STIGs) as starting configurations
Enable logging: Configure systems to log security events and forward them to a central monitoring system

Logging and Monitoring

Tool / Concept	Description
SIEM	Security Information and Event Management; collects logs from many sources, correlates events, and generates alerts for suspicious activity. Examples: Splunk, Microsoft Sentinel, IBM QRadar.
Log Management	Centralized collection, storage, and retention of log data. Essential for incident investigation, compliance, and forensics. Logs should be protected from tampering.
Continuous Monitoring	Ongoing automated observation of systems for security events, configuration changes, and policy violations. Enables rapid detection and response.
Audit Trails	Chronological records of system activities that provide accountability and support forensic investigation

Change Management

Purpose: Ensure that changes to IT systems are planned, tested, approved, and documented to minimize disruption and security risks
Request: Submit a formal change request describing what, why, when, and potential impact
Review: Change Advisory Board (CAB) or appropriate authority reviews the request for risk and impact
Test: Test the change in a non-production environment before deployment
Approve: Obtain formal approval before implementing the change
Implement: Apply the change during an approved maintenance window
Document: Record all details including rollback procedures in case the change causes issues

Security Awareness Training

Topic	What Users Should Know
Phishing	How to recognize suspicious emails, links, and attachments; when and how to report them
Password Hygiene	Using strong, unique passwords; using a password manager; never sharing credentials
Physical Security	Never tailgate; always badge in; lock workstations when away; report unknown individuals
Data Handling	Proper classification, labeling, storage, and disposal of sensitive information
Social Engineering	Recognizing manipulation tactics (pretexting, baiting, quid pro quo); verifying identities before sharing information

Tip: People are often the weakest link in security. Regular, engaging security awareness training with simulated phishing exercises is one of the most cost-effective security controls an organization can implement.

CC Quick Reference & Key Comparisons

This section consolidates the most commonly tested comparisons and frequently confused concepts from across all five CC domains. Use this as a rapid review before your exam.

Authentication vs Authorization vs Accountability

Concept	Question It Answers	Example
Authentication	Who are you? (Proving identity)	Entering username and password
Authorization	What can you do? (Granting access)	File permissions, group membership
Accountability	What did you do? (Tracking actions)	Audit logs, SIEM records

Preventive vs Detective vs Corrective Controls

Type	When It Acts	Examples
Preventive	Before the incident (stops it from happening)	Firewall, encryption, locks, training
Detective	During / after the incident (identifies it happened)	IDS, CCTV, log review, audits
Corrective	After the incident (fixes the damage)	Patching, backup restore, incident response

IDS vs IPS

Feature	IDS	IPS
Action	Detects and alerts only	Detects, alerts, and blocks
Placement	Passive (monitors a copy of traffic)	Inline (traffic flows through it)
Impact on Traffic	None (cannot stop attacks)	Can add latency but actively stops attacks
Control Type	Detective	Preventive

Encryption vs Hashing

Feature	Encryption	Hashing
Reversible?	Yes (with the correct key)	No (one-way function)
Purpose	Confidentiality (protect data from unauthorized access)	Integrity (verify data has not been altered)
Key Required?	Yes	No (but HMAC uses a key)
Output Size	Varies with input size	Fixed length (e.g., SHA-256 = 256 bits)
Examples	AES, RSA, 3DES	SHA-256, SHA-3, MD5 (deprecated)

Hot Site vs Warm Site vs Cold Site

Feature	Hot	Warm	Cold
Equipment	Full hardware + current data	Some hardware, no current data	Empty facility
Recovery	Minutes to hours	Hours to days	Days to weeks
Cost	Highest	Moderate	Lowest

Threat vs Vulnerability vs Risk

Term	Definition	Example
Threat	Potential cause of harm	Hacker, earthquake, disgruntled employee
Vulnerability	Weakness that can be exploited	Unpatched software, weak password, open port
Risk	Likelihood of threat exploiting vulnerability times impact	Probability that a hacker exploits an unpatched server

Tip: Risk = Threat x Vulnerability x Impact. You can reduce risk by eliminating the vulnerability (patching), reducing the threat (network segmentation), or minimizing the impact (backups, encryption). If any factor is zero, the risk is zero.

CC

ISC2 Certified in Cybersecurity

CC Practice Exam 1

CC Practice Exam 2

CC Practice Exam 3

CC Practice Exam 4

CC Practice Exam 5

CC Practice Exam 6

Unlock All Content for CC

Preview (10 / 120)

Flash Cards

Available Languages

Exam Topics

CC Cheat Sheet

ISC2 Certified in Cybersecurity (CC)

Exam Details

Domain Weight Breakdown

ISC2 Certification Path

Domain 1: Security Principles (26%)

The CIA Triad

Authentication Factors

Security Governance Concepts

Risk Management Basics

Security Controls Categories

ISC2 Code of Ethics

Domain 2: Business Continuity, Disaster Recovery & Incident Response (10%)

BCP vs DR

Key Recovery Metrics

Disaster Recovery Site Types

Incident Response Process

Backup Strategies

Domain 3: Access Controls Concepts (22%)

Key Access Control Principles

Access Control Models

Physical Access Controls

Logical Access Controls

Identity Management Lifecycle

Domain 4: Network Security (24%)

OSI Model Overview

Network Security Devices

Network Segmentation Concepts

Common Network Threats

Secure Protocols

VPN (Virtual Private Network)

Domain 5: Security Operations (18%)

Data Security Practices

System Hardening

Logging and Monitoring

Change Management

Security Awareness Training

CC Quick Reference & Key Comparisons

Authentication vs Authorization vs Accountability

Preventive vs Detective vs Corrective Controls

IDS vs IPS

Encryption vs Hashing

Hot Site vs Warm Site vs Cold Site

Threat vs Vulnerability vs Risk