What it asks for. In CSF 1.1 this Protect category covered security policies, processes and procedures such as configuration baselines, secure development life cycles, change control, backups, response and recovery plans, and vulnerability management planning. CSF 2.0 removed it and distributed its subcategories across PR.PS, PR.DS, ID.IM, GV.PO and others. PR.IP-12 dealt with developing and implementing a vulnerability management plan.
In practice. The organisation documents and follows processes for baselines, change control, backups, data destruction and personnel security, and maintains tested response and recovery plans. A vulnerability management plan defines scanning, prioritisation, remediation timelines and exceptions. Evidence includes procedures, change records, plan tests and vulnerability metrics.
Common gaps. Processes are often documented but not followed, and plans are not tested. Vulnerability management plans may lack clear remediation timelines or an exception process.