The second phase of the Journey follows the Protect function of NIST CSF 2.0: with the priorities from the Identify phase, Vortex recommends, deploys, integrates and manages identity, data, platform and infrastructure safeguards, in IT and OT.
In short: The Protect phase of the Vortex Cybersecurity Journey follows the Protect function of NIST CSF 2.0, whose outcome is this: “Safeguards to manage the organization’s cybersecurity risks are used.” With the priorities from the roadmap of the Identify phase, Vortex recommends technologies in a vendor-agnostic way, based on technical, regulatory and financial criteria, deploys them with the leading cybersecurity vendors, integrates them into the environment and manages the operation with managed security services (MSS). The phase covers the function’s five categories: identity and access, awareness and training, data security, platform security and infrastructure resilience, in IT and OT. What protection does not prevent is detected and responded to in the Detect and Respond phase, by the Cyber Defense Center.
In NIST CSF 2.0, once assets and risks are identified and prioritized, the Protect function applies the safeguards that prevent or lower the likelihood and impact of adverse events. It has five categories.
| Category | What the framework asks for | How Vortex delivers it |
|---|---|---|
| Identity Management, Authentication, and Access Control (PR.AA) | Identities and credentials of users, services and hardware managed; authentication commensurate with risk; access permissions defined in a policy, enforced and reviewed, with least privilege and separation of duties; physical access managed (PR.AA-01 to PR.AA-06) | MFA and SSO for authentication; privileged access management (PAM), endpoint privilege management (EPM) and management of application and service secrets; access based on identity, device and context with ZTNA and NAC; in OT, remote access by vendors, technicians and operators controlled, authenticated and monitored. Physical access (PR.AA-06) is not part of the catalog |
| Awareness and Training (PR.AT) | Personnel with the knowledge and skills to perform their tasks with cybersecurity risks in mind, including those in specialized roles (PR.AT-01 and PR.AT-02) | Awareness platform with learning paths, and phishing simulations that measure the response rate and point out behavioral vulnerabilities. Tabletop exercises with leadership and technical teams are in the Identify phase (ID.IM). Training for specialized roles (PR.AT-02) is not part of the catalog |
| Data Security (PR.DS) | Confidentiality, integrity and availability of data at rest, in transit and in use; backups created, protected, maintained and tested (PR.DS-01, PR.DS-02, PR.DS-10 and PR.DS-11) | Data loss prevention (DLP); full disk encryption (FDE); visibility and control over SaaS use (CASB); governance of who accesses which data, with permission auditing and recertification. Data discovery and classification are in the Identify phase (ID.AM). Backup and restore (PR.DS-11) are not part of the catalog |
| Platform Security (PR.PS) | Configuration management; software and hardware maintained, replaced and removed commensurate with risk; log records generated for continuous monitoring; installation and execution of unauthorized software prevented; secure software development (PR.PS-01 to PR.PS-06) | Hardening review and support; patch management; protection of endpoints (EPP and EDR), mobile devices (MDM) and, in OT, industrial devices (OT-EDR); cloud and workload posture and protection (CSPM and CNAPP); DevSecOps and container security. Logs go to the Cyber Defense Center SIEM, in the Detect and Respond phase. EDR and OT-EDR also detect and contain attacks (DE.CM-09 and RS.MI-01) |
| Technology Infrastructure Resilience (PR.IR) | Networks and environments protected from unauthorized logical access and usage; protection from environmental threats; resilience mechanisms in normal and adverse situations; adequate resource capacity to ensure availability (PR.IR-01 to PR.IR-04) | Next-generation firewall (NGFW) and rule base auditing; micro-segmentation; SASE, web gateway, and web browsing and email security; WAF, API security and bot management for exposed applications; DDoS protection for availability; in OT, segmentation and traffic control between industrial zones. Protection from environmental threats (PR.IR-02) is not part of the catalog |
Categories and subcategories summarized by Vortex from NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, February 26, 2024 (official text).
Each safeguard goes through four steps, in the order of priority that the Identify phase defined: recommend, deploy, integrate and manage.
Which safeguard reduces your risk?
What you get
How do you put the safeguard in place?
What you get
Do the safeguards work in your context?
What you get
Who keeps protection working?
What you get
Priorities come from the Identify phase, and what protection does not prevent is detected and responded to in the Detect and Respond phase, by the Cyber Defense Center.
Grouped by the five categories of the NIST CSF 2.0 Protect function. EDR and OT-EDR sit with endpoint protection and also feed detection and containment by the Cyber Defense Center (DE.CM-09 and RS.MI-01), in the Detect and Respond phase.
Identity and access (PR.AA) 8
Identity and access (PR.AA)
Multi-Factor Authentication is an additional layer of protection that requires multiple forms of verification to authenticate user access. By combining something the user knows (password), has (token) or is (biometrics), the solution makes unauthorized access harder, even when credentials have been leaked.
Identity and access (PR.AA)
Single Sign-On is a technology that lets users access multiple systems with a single authentication. This simplifies the user experience, improves productivity and reduces the risks of using multiple weak or reused passwords.
Identity and access (PR.AA)
Privileged Access Management is a solution that controls and protects the use of privileged accounts within the organization. The tool applies access policies, records sessions and limits the use of sensitive credentials, drastically reducing the risk of abuse or compromise of critical access.
Identity and access (PR.AA)
Endpoint Privilege Management is a tool for controlling local privileges on workstations and servers. The solution ensures that users have only the access that is strictly necessary, reducing the attack surface and preventing the improper execution of commands with elevated privileges.
Identity and access (PR.AA)
Vault and life cycle management for non-human secrets (API keys, tokens, TLS certificates, service credentials), with automatic rotation, secure injection at runtime and auditing.
Identity and access (PR.AA)
Zero Trust Network Access is a solution that applies the principle of “never trust, always verify” to remote and internal access to applications and systems. The tool ensures that only authenticated and authorized users and devices can access specific resources, based on granular policies. This reduces the attack surface and prevents lateral movement in the event of a compromise.
Identity and access (PR.AA)
Authentication and authorization of devices connected to the network (802.1X), automatic identification of endpoints, quarantine of non-compliant devices and access policies by profile.
Identity and access (PR.AA)
OT-Secure Remote Access is a secure remote access solution designed specifically for industrial (OT) environments. The tool controls, authenticates and monitors remote connections by vendors, technicians and operators to the operational environment. This ensures that access takes place with traceability and encryption and within security policies, reducing the risks associated with unauthorized or poorly managed connections.
Awareness and training (PR.AT) 2
Awareness and training (PR.AT)
User Awareness Platform is a solution for the continuous training of employees in cybersecurity best practices. The platform offers interactive content and learning paths that promote a security culture and reduce human risk in the organization.
Awareness and training (PR.AT)
Phishing Training Platform is a tool that simulates phishing attacks to train and assess users in real-world scenarios. The solution measures the response rate, identifies behavioral vulnerabilities and provides reports that help reinforce awareness and correct weaknesses.
Data security (PR.DS) 4
Data security (PR.DS)
Data Loss Prevention is a tool that monitors, detects and prevents the leakage of sensitive data through channels such as email, web browsing, removable devices and uploads. The solution applies protection policies to ensure that critical information remains secure and compliant with regulatory standards.
Data security (PR.DS)
Full Disk Encryption is a solution that encrypts the entire contents of devices, protecting stored data even in the event of physical loss or theft. The technology ensures that only authorized users can access the information, and it is essential for protecting confidentiality in mobile environments.
Data security (PR.DS)
Cloud Access Security Broker is a security tool that acts as an intermediary between users and cloud services. It offers visibility, control and protection over the use of SaaS, IaaS and PaaS applications, detecting risky behavior, monitoring access and applying compliance and sensitive data protection policies.
Data security (PR.DS)
Governance of who accesses which data: continuous auditing of permissions on file shares and SaaS, periodic recertification, detection of anomalous access and cleanup of legacy access.
Platform security (PR.PS) 10
Platform security (PR.PS)
Review of the configuration of systems, servers and devices against hardening benchmarks, and support in implementing the fixes.
Platform security (PR.PS)
Patch Management is a tool that automates the updating of operating systems, applications and drivers. It identifies security flaws fixed by vendors and applies the patches in an organized way, reducing the window of exposure to known vulnerabilities and keeping the environment up to date.
Platform security (PR.PS)
The Endpoint Protection Platform is a solution that protects end-user devices against known threats, such as malware, ransomware and signature-based attacks. The tool performs scans, monitors behavior and applies protection policies to prevent compromise, acting as a first line of defense on the organization’s endpoints.
Platform security (PR.PS)
EDR is an advanced technology that continuously monitors activity on endpoints, detecting suspicious behavior and investigating potential incidents in real time. The solution collects and analyzes data to identify sophisticated attacks, enabling rapid response, threat containment and detailed forensic analysis.
Platform security (PR.PS)
Mobile Device Management is a solution for managing, protecting and controlling corporate or personal mobile devices used in the workplace. The technology applies security policies, controls access, performs remote wipes and ensures compliance even in BYOD (Bring Your Own Device) environments.
Platform security (PR.PS)
Cloud Security Posture Management is a tool that continuously analyzes the configuration of public or hybrid cloud environments, detecting security deviations, compliance failures and vulnerabilities. In the managed model, Vortex fixes the misconfigurations, to keep the cloud aligned with security best practices and regulatory standards.
Platform security (PR.PS)
A unified platform that covers CSPM, workload protection (CWPP), Kubernetes posture (KSPM) and identity permissions (CIEM). It protects cloud-native workloads from build to runtime.
Platform security (PR.PS)
Security integrated into the development life cycle: automated SAST, DAST and SCA in CI/CD, configurable security gates, automated threat modeling and shift-left of security practices.
Platform security (PR.PS)
Security for containerized applications: base image hardening, admission control, runtime protection, Kubernetes visibility and detection of anomalous behavior in pods.
Platform security (PR.PS)
OT-EDR is a detection and response solution for devices in industrial (OT) environments. The tool continuously monitors industrial assets, detecting anomalous behavior and potential targeted attacks. This enables fast, safe responses in critical production environments.
Infrastructure resilience (PR.IR) 12
Infrastructure resilience (PR.IR)
The Next Generation Firewall is a network security solution that combines traditional firewall functions with advanced capabilities, such as deep packet inspection, intrusion prevention (IPS), application control and threat intelligence integration. This technology enables more granular traffic analysis, offering protection against modern attacks and ensuring control of communications in corporate environments.
Infrastructure resilience (PR.IR)
Firewall Assessment Workflow is a tool that analyzes the configuration and the existing rules of the organization’s firewalls. Its goal is to identify excessive permissions, obsolete or misconfigured rules and security gaps that could compromise the environment. Based on this analysis, Vortex delivers the optimization in phases, in the managed model, with before-and-after metrics and a continuous governance roadmap.
Infrastructure resilience (PR.IR)
Logical segmentation by workload and application, not just by network. It limits lateral movement in flat environments and data centers, and it is essential for Zero Trust in the internal environment.
Infrastructure resilience (PR.IR)
Convergence of networking (SD-WAN) and cloud security (SWG, CASB, ZTNA and FWaaS) in a single platform, delivered as a service. The reference architecture for protecting distributed teams.
Infrastructure resilience (PR.IR)
Web Security is an internet access protection solution that monitors, filters and blocks malicious content, suspicious downloads and unsafe sites. This technology protects users against web threats such as phishing, malware and ransomware, while enabling browsing policies aligned with corporate security.
Infrastructure resilience (PR.IR)
Secure Web Gateway is a solution that inspects and filters all of the organization’s internet traffic, protecting users against online threats and unauthorized access. The tool prevents communication with malicious sites, blocks inappropriate content and offers granular control over web traffic, even in distributed or remote environments.
Infrastructure resilience (PR.IR)
Email Security is a technology focused on protecting the main entry point for threats into an organization: email. The solution performs advanced analysis of incoming and outgoing messages, blocking spam, malicious links, phishing attempts and dangerous attachments. It also helps prevent data leakage and social engineering fraud.
Infrastructure resilience (PR.IR)
Web Application Firewall is a solution that protects web applications against common attacks, such as injection, cross-site scripting (XSS) and the exploitation of known vulnerabilities. The tool inspects HTTP/S traffic and blocks malicious behavior, ensuring the integrity of applications exposed to the internet.
Infrastructure resilience (PR.IR)
API Security is a technology that protects application programming interfaces (APIs) against abuse, improper access and data leakage. The solution performs authentication, traffic verification and anomaly detection, ensuring that APIs operate securely and within the expected parameters.
Infrastructure resilience (PR.IR)
Detection and mitigation of malicious bots (credential stuffing, scraping, inventory hoarding, account takeover) with behavioral fingerprinting, adaptive challenges and machine learning for evasive bots.
Infrastructure resilience (PR.IR)
Mitigation of distributed denial-of-service attacks at layers 3, 4 and 7, with an on-premises appliance, cloud scrubbing or a hybrid model, with automatic detection and mitigation in less than one second.
Infrastructure resilience (PR.IR)
OT Network Security is a segmentation and traffic control solution for industrial networks. The tool applies rules specific to OT environments, isolating critical zones, blocking improper communications and protecting automation systems against external or internal threats.
Vortex works in a vendor-agnostic way: technologies are recommended by the diagnostic, according to each organization’s environment and risks.
Vendor-agnostic recommendation, deployment, integration and management of security technologies for network, cloud, endpoint, identity, applications, data and OT.
Discover the serviceZero trust, MFA, DLP, EDR and other security terms, defined in plain language, with sources.
Open the glossary (PT)What ANEEL’s REN 964 and the ONS routine require, how IEC 62443 fits in, and a practical checklist.
Read the guide (PT)The outcome of the Protect function is this: “Safeguards to manage the organization’s cybersecurity risks are used.” Once assets and risks are identified and prioritized, it secures those assets to prevent or lower the likelihood and impact of adverse events. It has five categories: Identity Management, Authentication, and Access Control (PR.AA); Awareness and Training (PR.AT); Data Security (PR.DS); Platform Security (PR.PS); and Technology Infrastructure Resilience (PR.IR) (NIST CSF 2.0).
Zero trust is the security model that grants no implicit trust to a user, device or account because it is on the internal network or belongs to the company: each access to a resource is authenticated and authorized beforehand, with least privilege (NIST SP 800-207). The principle is “never trust, always verify.” In the Protect phase, the model appears in Zero Trust Network Access (ZTNA), for remote and internal access to applications and systems, and in micro-segmentation, which limits lateral movement in the internal environment, with MFA and privileged access management (PAM) in identity and access control.
In NIST CSF 2.0, understanding and managing legal, regulatory and contractual cybersecurity requirements is part of the Govern function (GV.OC-03). In the Vortex Journey, this is in the Identify phase, with preparation for Brazil’s LGPD (General Data Protection Law), PCI-DSS and ISO/IEC 27001, verification of policy compliance and the development of policies and standards. The Protect phase implements the safeguards that these requirements call for.
Because, in the Vortex Journey, EDR is deployed together with endpoint protection, alongside EPP, patch management and MDM. Once deployed, what it does also belongs to the Detect and Respond functions of NIST CSF 2.0: monitoring endpoints to find adverse events (DE.CM-09) and containing incidents (RS.MI-01). That is why EDR is one of the sources of the Cyber Defense Center MDR, together with SIEM, NDR and XDR. The same applies to OT-EDR, on industrial devices.
It is the model in which Vortex operates the company’s security solutions, in addition to deploying them. In the Protect phase, Vortex recommends technologies in a vendor-agnostic way, based on technical, regulatory and financial criteria, deploys them with the leading cybersecurity vendors, integrates them into the environment and manages the operation, so that each solution is implemented, integrated and operated effectively. Security Integration details the service.
With three safeguards specific to industrial environments: segmentation and traffic control of OT networks, which isolate critical zones and block improper communications; secure remote access, which controls, authenticates and monitors connections by vendors, technicians and operators; and OT-EDR, on industrial devices. Priorities come from the passive inventory and the OT Risk Assessment of the Identify phase, by physical impact on the process.
Tell us a little about your environment and your priorities. A Vortex specialist will get back to you to recommend the safeguards and the management model.
Updated on
