What it asks for. In CSF 1.1 this Protect category covered technical security solutions that protect systems and assets, including audit logging, removable media control, least functionality, protection of communications and control networks, and resilience mechanisms. CSF 2.0 removed it, moving content mainly to PR.PS (Platform Security) and PR.IR (Technology Infrastructure Resilience). PR.PT-4 addressed protection of communications and control networks.
In practice. Networks are segmented, perimeter and internal traffic is filtered, communications are encrypted, and logging and least functionality are enforced through technical controls. Control networks such as OT are separated from business networks. Evidence includes network diagrams, firewall rule reviews and logging configurations.
Common gaps. Flat networks and broad firewall rules remain common, and OT or management networks are often reachable from user segments. Rule bases accumulate obsolete entries without review.