> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/regulatory-framework-mappings/nist-csf-1.1/protect.md). # Protect ### Identity Management, Authentication, and Access Control (PR.AC) NIST Definition: *Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.* | **Section** | **How Dispel Helps** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | |

PR.AC-1

Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes.

| Dispel systems can provide strong identity and authentication such as multi-factor authentication overlay even to legacy systems. Dispel provides simple methods for auditing/revoking authorized users/systems. | |

PR.AC-3

Remote access is managed.

| Dispel infrastructure provides a simple and secure system for remote access, enforces multi-factor authentication, and enforces the use of organization controlled systems—virtual machines, which are auditable, monitored, and recorded. | |

PR.AC-4

Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.

| Dispel systems can provide segmentation and limit access to only designated systems. Dispel’s Enclave Networks are built upon principles of Zero-Trust and Least Privilege. | ### Awareness and Training (PR.AT) NIST Definition: *The organization’s personnel and partners are provided cybersecurity awareness education and are trained to perform their cybersecurity-related duties and responsibilities consistent with related policies, procedures, and agreements.* | **Section** | **How Dispel Helps** | | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | |

PR.AT-1

All users are informed and trained.

| For admins, Dispel’s personnel provide training and onboarding. For users, Dispel’s systems are designed to aid in automatic security enforcement through the user onboarding process. | |

PR.AT-2

Privileged users understand their roles and responsibilities.

| Dispel’s systems are designed to aid in automatic security enforcement, based upon the principles of least privilege, segmentation, and zero trust. Clear roles and responsibilities are established for all user types. | ### Data Security (PR.DS) NIST Definition: *Information and records (data) are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.* | **Section** | **How Dispel Works** | | ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | |

PR.DS-1

Data-at-rest is protected.

| Data stored can be encrypted at rest. | |

PR.DS-2

Data-in-transit is protected.

| All data flowing through Dispel systems are end-to-end encrypted with two layers of AES-256 with 4096-bit RSA. | |

PR.DS-4

Adequate capacity to ensure availability is maintained.

| Dispel can provide rapid scaling of systems based on demand. This includes hot or warm redundancy to ensure availability. | |

PR.DS-5

Protections against data leaks are implemented.

| Dispel provides strong segmentation, encryption, reduction of access and removal of public access to ports and IP addresses. Further, Dispel’s Enclaves are protected against DNS, IPv4, IPv6, and WebRTC leaks. | |

PR.DS-6

Integrity checking mechanisms are used to verify software, firmware, and information integrity.

| When launching, Dispel systems check to make sure VDIs and networks are running as needed, and destroys/re-builds if not. All of Dispel’s virtual machines are built with the latest security updates and patches. | ### Information Protection (PR.IP) NIST Definition: *Security policies (that address purpose, scope, roles, responsibilities, management commitment, and coordination among organizational entities), processes, and procedures are maintained and used to manage protection of information systems and assets.* | **Section** | **How Dispel Works** | | ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

PR.IP-1

A baseline configuration of information technology/industrial control systems.

| Dispel networks segment ICS systems so that access is granted to systems only-as-needed. | |

PR.IP-6

Data is destroyed according to policy.

| Dispel’s platform allows for the full destruction of Enclave Networks–removing the required associated data according to policy. | |

PR.IP-7

Protection Processes are removed.

| Dispel networks and resources automatically launch with the latest patches, aiding in improving protection processes as they are developed. Dispel’s platform enforces least privilege and temporary access for remote users. | |

PR.IP-11

Cybersecurity is included in human resources practices (e.g. deprovisioning, personnel screening).

| Dispel helps link cybersecurity with HR practices by integrating with the AD, and by creating fully disposable networks that can cycle with user involvement. Finally, Dispel’s simple onboarding procedure enables a non-technical admin/workforce. | ### Maintenance (PR.MA) NIST Definition: *Maintenance and repairs of industrial control and information system components are performed consistent with policies and procedures.* | **Section** | **How Dispel Works** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

PR.MA-1

Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools.

| Dispel systems are patched automatically, and can be refreshed in under 30 min. Dispel’s remote access platform allows the organization to control/audit how vendors/partners gain access to update their critical infrastructure. | |

PR.MA-2

Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.

| Dispel infrastructure provides simple and secure system for remote access, enforces multi-factor authentication, and enforces use of organization controlled system – virtual machines, which are auditable, monitored, and recorded. | ### Protective Technology (PR.PT) NIST Definition: *Technical security solutions are managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreements.* | **Section** | **How Dispel Works** | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

PR.PT-1

Audit/log records are determined, documented, implemented, and reviewed in accordance with policy.

| Dispel’s traffic logging aids in documenting log records for audit. | |

PR.PT-3

The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.

| Dispel systems can provide, read or view only access, as well as provide one way push of data. All of Dispel’s virtual infrastructure is built according to the principle of least functionality. | |

PR.PT-4

Communications and control networks are protected.

| Dispel can segment communications and control networks, as well as provide off channel and backup communication channels. | |

PR.PT-5

Mechanisms (e.g. failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.

| Dispel can segment communications and control networks, as well as provide off channel and backup communication channels. Full hot-swappable network redundancy can be configured. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.dispel.com/regulatory-framework-mappings/nist-csf-1.1/protect.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.