What it asks for. The Protect function asks organisations to use safeguards to manage their cybersecurity risks. It covers identity management, authentication and access control, awareness and training, data security, platform security, and technology infrastructure resilience.
In practice. Doing this well means safeguards are selected according to the risk assessment rather than applied uniformly. Access follows least privilege with strong authentication, staff receive role-relevant training, data is protected at rest and in transit, systems are hardened and patched, software is developed securely, and backups are created and tested. Evidence includes configuration baselines, patch compliance reports, MFA coverage, training completion, encryption settings and backup test results.
Common gaps. Organisations often invest unevenly, for example strong perimeter controls with weak identity hygiene. Protection is frequently measured by tool deployment rather than by coverage and effectiveness.