A data centre sits on a flood plain, and a separate system has no network connectivity at all. Which SP 800-30 concept do both illustrate?

Answer: B. A predisposing condition, which raises or lowers the chance a threat event causes harm

A predisposing condition affects — increases or decreases — the likelihood that threat events result in adverse impacts. NIST uses a flood-prone location and a stand-alone system with no external connectivity as its two examples.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.1 Risk Models — Predisposing Conditions