ModSecurity Vendor and Rule Sets?

Hi, I have 2 questions about setting up the ModSecurity WAF. 1) Even though ModSecurity is installed in cPanel and turned on for domains if a vendor rule set is not installed (like OWASP" ModSecurity Core Rule Set) ModSecurity is not actually protecting those domains since it doesn't have any rules to apply to incoming traffic. Is that correct? 2)