# NIST PF PROTECT Function — Assessment Template

## PR.AC — Access Control

| Subcategory | Control | Status | Evidence | Gap | Owner |
|-------------|---------|--------|----------|-----|-------|
| PR.AC-P1 | Identity/credential mgmt | | | | |
| PR.AC-P2 | Physical access | | | | |
| PR.AC-P3 | Remote access | | | | |
| PR.AC-P4 | Least privilege | | | | |
| PR.AC-P5 | Network integrity | | | | |
| PR.AC-P6 | Identity proofing | | | | |

## PR.DS — Data Security

### Encryption Inventory

| System | At Rest | In Transit | Key Mgmt | Rotation | Compliant |
|--------|---------|-----------|----------|----------|-----------|
| | | | | | |

### DLP Coverage

| Channel | DLP Active | Detection Rules | Action | Last Tested |
|---------|-----------|-----------------|--------|------------|
| Email | | | | |
| Web upload | | | | |
| Cloud storage | | | | |
| Endpoint | | | | |

## PR.PO — Protective Policies

| Subcategory | Policy | Status | Last Reviewed | Next Review |
|-------------|--------|--------|-------------|-------------|
| PR.PO-P1 | Baseline configs | | | |
| PR.PO-P3 | Backup policy | | | |
| PR.PO-P5 | Data destruction | | | |
| PR.PO-P7 | IR/BC plans | | | |
| PR.PO-P10 | Vulnerability mgmt | | | |

## Sign-Off

| Role | Name | Date |
|------|------|------|
| CISO | | |
| Privacy Engineer | | |
| CPO/DPO | | |