Skip to main content

💼 Information Protection Processes and Procedures (PR.IP)

  • Contextual name: 💼 Information Protection Processes and Procedures (PR.IP)
  • ID: /frameworks/nist-csf-v1.1/pr-ip
  • Located in: 💼 NIST CSF v1.1

Description​

Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.

Similar​

  • Internal
    • ID: dec-b-d064a5fc

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)414
💼 PR.IP-2: A System Development Life Cycle to manage systems is implemented66
💼 PR.IP-3: Configuration change control processes are in place44
💼 PR.IP-4: Backups of information are conducted, maintained, and tested55
💼 PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met
💼 PR.IP-6: Data is destroyed according to policy
💼 PR.IP-7: Protection processes are improved2
💼 PR.IP-8: Effectiveness of protection technologies is shared77
💼 PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed33
💼 PR.IP-10: Response and recovery plans are tested11
💼 PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)
💼 PR.IP-12: A vulnerability management plan is developed and implemented78