nist-pf-protect
Installation
SKILL.md
NIST Privacy Framework — PROTECT Function
Overview
The PROTECT function develops and implements appropriate data processing safeguards to prevent cybersecurity-related privacy events. This function directly bridges the NIST Cybersecurity Framework and Privacy Framework, addressing the overlap where security controls serve privacy objectives. It covers access control, data security, and protective policies.
PROTECT Function Subcategories
PR.AC — Access Control
Managing access to data and systems to protect privacy.
| Subcategory | Description | Implementation Guidance |
|---|---|---|
| PR.AC-P1 | Identities and credentials are issued, managed, verified, revoked, and audited for authorized individuals, processes, and devices | Implement identity lifecycle management. Enforce MFA for systems processing personal data. Conduct quarterly access reviews. |
| PR.AC-P2 | Physical access to data and devices is managed | Restrict physical access to data centers and server rooms. Implement visitor logging. Secure endpoint devices with encryption and remote wipe capability. |
| PR.AC-P3 | Remote access is managed | Enforce VPN for remote access to personal data systems. Implement zero-trust network architecture. Monitor and log all remote sessions. |
| PR.AC-P4 | Access permissions and authorizations are managed with least privilege and separation of duties | Implement role-based access control (RBAC). Enforce separation of duties for sensitive operations. Regular privileged access reviews. |
| PR.AC-P5 | Network integrity is protected | Network segmentation for systems processing personal data. Intrusion detection/prevention systems. Encrypted network communications. |
| PR.AC-P6 | Individuals and devices are proofed and bound to credentials | Implement strong identity verification for data subject account creation. Device certificate management. Biometric authentication where appropriate. |