ISC2 CC glossary of core controls, risk terms, traps, and decision cues.
Use this glossary when Certified in Cybersecurity (CC) terms start to blur together. The goal is practical recognition, not encyclopedia coverage.
| Term | Exam meaning |
|---|---|
| CIA triad | Confidentiality, integrity, and availability. |
| Confidentiality | Preventing unauthorized disclosure. |
| Integrity | Preventing unauthorized or undetected change. |
| Availability | Keeping systems and data usable when needed. |
| Authentication | Proving an identity. |
| Authorization | Granting allowed actions after identity is known. |
| Accountability | Tying actions to an identity through logs and audit. |
| Non-repudiation | Reducing ability to deny an action, often through signatures and audit evidence. |
| Privacy | Proper handling of personal data according to policy and law. |
| MFA | Multi-factor authentication using more than one proof category. |
| Least privilege | Granting only the access needed for a role or task. |
| Incident response | Process for handling security events and restoring safe operations. |
| Risk | Combination of likelihood and impact around an uncertain event. |
| Threat | Potential cause of harm. |
| Vulnerability | Weakness that could be exploited. |
| Control | Safeguard that reduces risk. |
| Business continuity | Planning to keep essential operations running during disruption. |
| Disaster recovery | Restoring IT systems and data after disruption. |
| RTO | Maximum acceptable time to restore. |
| RPO | Maximum acceptable data loss measured in time. |
| BIA | Business impact analysis; identifies critical processes and disruption impact. |
| IDS | Intrusion detection system. |
| IPS | Intrusion prevention system. |
| DMZ | Network segment that separates public-facing services from internal systems. |
| VLAN | Logical network segmentation. |
| VPN | Encrypted tunnel for remote or site-to-site connectivity. |
| NAC | Network Access Control; controls device access to the network. |
| Hashing | One-way integrity check, not encryption. |
| Classification | Assigning data sensitivity level. |
| Pair | How to separate them |
|---|---|
| Confidentiality vs privacy | Confidentiality prevents disclosure; privacy governs appropriate personal-data handling. |
| Authentication vs authorization | Authentication proves identity; authorization decides permitted actions. |
| BCP vs DRP | BCP keeps business functions running; DRP restores IT systems. |
| RTO vs RPO | RTO is time to restore; RPO is acceptable data loss measured in time. |
| IDS vs IPS | IDS detects; IPS can prevent or block. |
| Hashing vs encryption | Hashing verifies integrity; encryption protects confidentiality and can be reversed with a key. |
| Policy vs procedure | Policy states intent/rule; procedure gives steps. |
| Control vs evidence | A control changes behavior; evidence proves behavior or supports investigation. |
| Prevention vs detection | Prevention blocks or reduces a bad event; detection finds or reports that it happened. |
Do not memorize terms in isolation. For each term, write one scenario where it is the best answer, one scenario where it is a distractor, and one signal that proves it worked.