Everyday computing, information and assets
Start with a service people need, then identify the information, technology, people and providers that make it possible.
Confidentiality, integrity, availability, privacy and AAA
Separate what security protects from how identity, permission and activity records help protect it.
Networks, layers, addresses, names and ports
Follow communication using layers, names, addresses and ports without confusing their functions.
Governance, controls, frameworks and policies
Understand how direction, accountability, risk decisions, obligations and controls fit together.
Professional conduct, due care and due diligence
Make professional judgments within your competence and the evidence available.
Risk concepts, scenarios, assessment and treatment
Describe a credible risk scenario before choosing a score, method or response.
Awareness, social engineering and security culture
Help people act securely through usable processes, verification, reporting and a learning culture.
Business continuity, disaster recovery and recovery objectives
Use business priorities to decide what must recover, how soon and with how much recoverable data.
Measures, metrics, risk indicators and management reporting
Measure the question you need to answer and report enough context for a useful decision.
Authentication, passwords and MFA
Learn what authentication evidence shows and why surrounding account controls still matter.
Identity lifecycle, least privilege and access-control models
Follow identities and permissions through joining, changing role and leaving, including non-human services.
Firewalls, zones, segmentation, Zero Trust and VPN boundaries
Use explicit policy and enforcement instead of assuming location, a product or a tunnel creates trust.
Wi-Fi, Bluetooth, embedded systems, OT, ICS and IoT
Compare connected technologies by their purpose, trust boundaries and consequences when they fail.
Cloud characteristics, service models and responsibilities
Understand cloud through characteristics, service boundaries and actual responsibilities.
Encryption, hashing, signatures and quantum-resistant cryptography
Choose a cryptographic purpose, then explain the trust and key assumptions.
Classifying, labelling, masking, retaining and sanitizing data
Connect handling rules to the life of information, including provider copies and disposal.
Logging, monitoring, SIEM, correlation and triage
Turn records into investigation while separating an alert from a confirmed incident.
Threat actors, threat intelligence and ATT&CK
Use threat context without turning motive labels or technique mappings into attribution.
Incident response, evidence and tabletop exercises
Prepare authority and communication, then use evidence to guide response and recovery.
Asset lifecycle, configuration, change and patch management
Treat configuration and patching as ongoing risk response with verification after change.
Security testing, team exercises and threat modelling
Choose a test for the assurance question and define authorization and limits first.
AI fundamentals and applications across the CC domains
Apply security foundations to AI inputs, models, identities, dependencies, outputs and decisions.
The CC-first and selected PECB Foundation routes
Understand the CC-first and selected paid PECB routes, separating study, passing and awarded credentials.
Practice, feedback and a fictional learning portfolio
Use retrieval, scenarios and feedback, then connect fictional work into a coherent portfolio.
What this path still needs
- Eight targeted introductory application gaps now have free source-backed guides, model reasoning and self-checks. They are paper learning resources, not live lab assurance or independently marked learner work.
- The official short knowledge check is selected-topic practice. A fresh full current-outline assessment with verified explanations and complete AI coverage remains unverified here; no fixed percentage predicts a CC pass.
- Commercial CC teaching is optional. New One Million free-course/exam enrollments closed on 20 May 2026; existing unexpired access is personal. Examination and maintenance costs remain separate.
- The nineteen-guide supplement has no dedicated full bot-identity lifecycle/behavioral-login case. See the new current-outline coverage register; related lessons do not establish complete practice.