The Protect function
The Protect function focuses on implementing safeguards to prevent or contain the impact of a cybersecurity event. Its primary goal is to ensure that critical services are delivered reliably by reducing the attack surface and protecting sensitive data.
What it means
In practice, this function acts as the "shield" for your organization. While other functions focus on identifying risks or responding to incidents, Protect is about proactive prevention. It encompasses technical controls, physical security, and administrative policies designed to keep unauthorized users out and protect assets from compromise.
The scope extends beyond just firewalls and passwords. It includes managing identities, securing the platforms where software runs, protecting data at rest and in transit, and ensuring that personnel are trained to avoid falling for social engineering attacks.
How to meet it
- Implement Multi-Factor Authentication (MFA) across all remote access points and privileged accounts.
- Enforce the Principle of Least Privilege (PoLP), ensuring users have only the minimum access necessary for their job functions.
- Encrypt sensitive data both while stored on disks (at rest) and while moving across networks (in transit).
- Establish a formal patch management process to keep operating systems, applications, and firmware updated against known vulnerabilities.
- Conduct regular security awareness training for all employees to mitigate human-centric risks like phishing.
- Segment your network to isolate critical assets from general guest or corporate traffic.
Evidence an auditor asks for
- User access review logs showing that permissions are audited and revoked when roles change or employment ends.
- Configuration screenshots or policy documents proving encryption is enabled on databases and communication channels (e.g., TLS settings).
- Training records and completion certificates demonstrating that staff have undergone security awareness training.
- Patching reports or vulnerability scan summaries showing a consistent cadence of updates applied to systems.
Common pitfalls
- Over-reliance on a single control, such as assuming a firewall is sufficient without implementing internal segmentation or MFA.
- "Privilege creep," where users accumulate permissions over time that are never revoked, violating the principle of least privilege.
- Implementing technical controls but failing to document the policies and procedures that govern them, leaving auditors with no baseline for compliance.