What it asks for. This Protect category requires that data is managed in line with the organisation's risk strategy to protect its confidentiality, integrity and availability. It covers data at rest, in transit and in use, integrity checks and, in CSF 2.0, backups.
In practice. Sensitive data is encrypted at rest and in transit, integrity mechanisms detect unauthorised changes, data leakage is controlled, development and production environments are separated, and backups are created, protected and tested. Controls are applied according to classification. Evidence includes encryption configurations, key management procedures, DLP policies and backup test records.
Common gaps. Encryption coverage is often assumed rather than verified, especially in cloud storage and SaaS. Data in use and data shared with third parties receive less attention than data in storage.