Of the six NIST CSF 2.0 functions, Protect is where the most day-to-day security work happens. It covers the controls your team operates continuously: who has access to what, whether that access is properly authenticated, how data is secured in motion and at rest, whether endpoints are patched, and whether your infrastructure can absorb disruption.
For SMBs, Protect is often where the largest gap between intent and reality exists. Organizations know they should have MFA, they know they should be encrypting laptops — but assessments routinely find these controls partially deployed or inconsistently applied. Protect maturity is measured not by whether a control exists, but by whether it’s applied uniformly across all users and systems.
Protect is also the function most directly scrutinized by cyber insurance underwriters and regulators. Expect specific questions about MFA coverage rates, encryption status, and patch cadence in every compliance questionnaire and insurance renewal. Gaps here cost real money.
The 5 Protect Categories
Common SMB Gaps in the Protect Function
- Shared admin passwords across multiple team members, violating PR.AA least-privilege and making breach attribution impossible.
- MFA not enforced on Microsoft 365 or Google Workspace — the primary attack vector in the majority of SMB credential breaches.
- Contractors or former developers retaining active access to production databases after project completion.
- Laptops without full-disk encryption (BitLocker/FileVault), a PR.DS gap that triggers mandatory notification in most state breach laws.
- No formal patch management schedule — critical vulnerabilities sitting open for 30–90 days, directly violating PR.PS.
- Security awareness training done once at onboarding, never reinforced — PR.AT requires an ongoing training cadence, not a one-time checkbox.
Protect and Regulatory Compliance
PR.DS maps directly to HIPAA’s Technical Safeguards for ePHI encryption. PR.AA aligns with PCI-DSS cardholder data access control requirements. Building your Protect controls against NIST CSF subcategories lets you satisfy requirements across frameworks without duplicating documentation. See the HIPAA alignment guide for the full mapping.