Which are the three pillars of cybersecurity?

Which are the three pillars of cybersecurity?

• A. People, Processes, and Technology
• B. People, Technology, and Risk
• C. Privacy, Compliance, and Control
• D. Data, Network, and Security

Answer: (A)

The three pillars are people, processes, and technology. This framing shows that cybersecurity isn’t just about fancy tools; it’s about how humans behave, the rules that govern actions, and the technical controls that enforce those rules. People are the first line of defense and the source of many security incidents if training lapses or social engineering is successful, so awareness, training, and culture matter just as much as any gadget. Processes provide structure: policies, procedures, incident response, access management, and audit trails keep actions consistent, repeatable, and accountable. Technology supplies the controls and capabilities—encryption, authentication, monitoring, firewalls, and automation—that enforce the policies and support safe user behavior. When these three work together, defenses are layered and resilient. Tools alone can fail without proper use and clear procedures, and training without real controls or governance won’t reliably reduce risk. The other options mix governance concerns or focus on assets like data or networks rather than the essential three-part framework that governs security in a holistic way.

The three pillars are people, processes, and technology. This framing shows that cybersecurity isn’t just about fancy tools; it’s about how humans behave, the rules that govern actions, and the technical controls that enforce those rules. People are the first line of defense and the source of many security incidents if training lapses or social engineering is successful, so awareness, training, and culture matter just as much as any gadget. Processes provide structure: policies, procedures, incident response, access management, and audit trails keep actions consistent, repeatable, and accountable. Technology supplies the controls and capabilities—encryption, authentication, monitoring, firewalls, and automation—that enforce the policies and support safe user behavior.

When these three work together, defenses are layered and resilient. Tools alone can fail without proper use and clear procedures, and training without real controls or governance won’t reliably reduce risk. The other options mix governance concerns or focus on assets like data or networks rather than the essential three-part framework that governs security in a holistic way.