PR.PS-02 focuses on maintaining, replacing, or removing software based on risk, including timely patching, updating container images, and phasing out end-of-life versions. This ensures software remains supported and secure, reducing vulnerabilities from outdated or unauthorized applications. It includes plans for obsolescence to manage lifecycle risks.

This subcategory strengthens resilience by uninstalling unnecessary or risky software components that could be exploited, aligning updates with vulnerability management timelines. It balances security with operational needs, ensuring only current, necessary software persists. PR.PS-02 keeps the software environment lean and protected.

PR.PS-01 establishes and applies configuration management practices to maintain secure baselines for hardware, software, and services, adhering to the principle of least functionality. This involves testing and deploying hardened configurations while reviewing defaults for potential risks during installations or upgrades. It ensures platforms are set up to minimize vulnerabilities.

This subcategory enhances security by monitoring systems for deviations from approved baselines, enabling quick correction of misconfigurations. It aligns configurations with organizational risk strategies, reducing the attack surface. PR.PS-01 provides a structured approach to platform security.

PR.DS-11 ensures that data backups are regularly created, securely stored, and tested to maintain availability and integrity for recovery purposes. This includes near-real-time backups for critical data, offline storage to protect against incidents, and annual testing to verify restorability. It supports resilience by enabling rapid restoration after disruptions.

This subcategory mitigates risks like data loss from ransomware or disasters by enforcing geographic separation and secure storage practices. It aligns backup strategies with organizational priorities, ensuring critical data is recoverable. PR.DS-11 provides a safety net for operational continuity.

PR.DS-10 protects data-in-use—actively processed in memory or applications—by removing it when no longer needed and isolating it from other users or processes on the same platform. This prevents unauthorized access or leakage during active operations, a critical concern for sensitive computations. It ensures data remains secure while being manipulated.

This subcategory enhances runtime security by implementing controls that safeguard data integrity and confidentiality in real-time environments. It aligns with risk strategies to protect high-value data during processing, reducing exposure. PR.DS-10 completes the triad of data protection across its states.

PR.DS-02 secures data-in-transit—moving across networks or communications—using encryption and integrity checks like digital signatures to prevent interception or alteration. This includes blocking or encrypting sensitive outbound emails and restricting access to personal communication tools on organizational systems. It ensures data remains protected during transmission.

This subcategory mitigates risks like eavesdropping or data leaks by enforcing secure channels and preventing sensitive data reuse in non-production environments. It aligns with risk priorities, applying stronger controls to high-value transmissions. PR.DS-02 safeguards data as it travels within and beyond the organization.

PR.DS-01 focuses on securing data-at-rest—stored in files, databases, or devices—using encryption, digital signatures, and physical controls to protect confidentiality, integrity, and availability. This includes full disk encryption for endpoints and restricting removable media to prevent unauthorized access or exfiltration. It safeguards data when it’s not actively being used.

This subcategory ensures that stored data remains trustworthy and accessible only to authorized parties, reducing risks like theft or corruption. It aligns protection measures with the organization’s risk strategy, prioritizing sensitive data types. PR.DS-01 forms a critical layer of defense for persistent data assets.

PR.AT-02 targets individuals in specialized roles—like cybersecurity staff, finance personnel, or senior leaders—with tailored training to address role-specific risks. This advanced education ensures they can manage complex tasks, such as handling critical data or responding to incidents, with security in mind. It extends beyond general awareness to meet unique job demands.

This subcategory enhances expertise by assessing specialized knowledge regularly and requiring annual refreshers to introduce evolving practices. It includes third parties in these roles, ensuring consistent competency across the ecosystem. PR.AT-02 strengthens the organization’s ability to manage high-stakes cybersecurity challenges.

PR.AT-01 ensures that all personnel—employees, contractors, and partners—receive basic cybersecurity awareness and training to handle tasks securely. This includes recognizing phishing attempts, adhering to acceptable use policies, and practicing cyber hygiene like password management. It builds a foundational layer of human-centric security across the organization.

This subcategory reinforces a security-conscious culture by explaining policy violation consequences and testing user understanding periodically. Annual refreshers keep knowledge current, addressing new threats and practices. PR.AT-01 empowers personnel to act as a first line of defense against common cyber risks.

PR.AA-06 addresses the management and monitoring of physical access to assets, using controls like security guards, cameras, and locked entries to restrict entry based on risk levels. High-risk areas receive enhanced protections, while guests or vendors are escorted to limit exposure. It prevents unauthorized physical interactions that could compromise systems or data.

This subcategory aligns physical security with cybersecurity goals, ensuring that facilities housing critical assets are safeguarded against tampering or theft. Continuous monitoring detects anomalies, enabling rapid response to breaches. PR.AA-06 complements logical access controls with robust physical defenses.

PR.AA-05 establishes a policy-driven approach to managing access permissions, ensuring they are granted based on need (least privilege) and distinct roles (separation of duties). This includes regular reviews to revoke unnecessary privileges, such as when roles change, and enforcement through technical controls. It minimizes the risk of excessive or conflicting access rights.

This subcategory supports a secure environment by aligning authorizations with risk levels, considering factors like geolocation or device health in dynamic systems like zero trust. It ensures accountability through periodic audits, maintaining proper access boundaries across the organization. PR.AA-05 balances usability with stringent access control.