What it asks for. In CSF 1.1 this Protect category required that access to physical and logical assets is limited to authorised users, processes and devices, consistent with the assessed risk. It covered identity and credential management, remote access, least privilege, network integrity and authentication. CSF 2.0 renamed it PR.AA and moved some network topics to PR.IR.
In practice. Identities and credentials are issued, managed and revoked through central processes, remote access is controlled, permissions follow least privilege and separation of duties, and authentication strength matches transaction risk, typically including multi-factor authentication. Physical access is managed too. Evidence includes identity life cycle records, access reviews, MFA coverage and physical access logs.
Common gaps. Gaps typically involve service accounts, privileged access sprawl and inconsistent MFA. Physical and logical access are often managed by separate teams with no joint review.