Skip to main content

💼 Information Protection Processes and Procedures (PR.IP)

  • Contextual name: 💼 Information Protection Processes and Procedures (PR.IP)
  • ID: /frameworks/nist-csf-v1.1/pr-ip
  • Located in: 💼 NIST CSF v1.1

Description​

Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.

Similar​

  • Internal
    • ID: dec-b-d064a5fc

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)426
💼 PR.IP-2: A System Development Life Cycle to manage systems is implemented69
💼 PR.IP-3: Configuration change control processes are in place55
💼 PR.IP-4: Backups of information are conducted, maintained, and tested47
💼 PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met
💼 PR.IP-6: Data is destroyed according to policy4
💼 PR.IP-7: Protection processes are improved2
💼 PR.IP-8: Effectiveness of protection technologies is shared66
💼 PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed33
💼 PR.IP-10: Response and recovery plans are tested11
💼 PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)
💼 PR.IP-12: A vulnerability management plan is developed and implemented79