Frameworks / NIST Privacy Framework / NISTPF-7 NIST Privacy Framework
Protect-P Maintenance and Technology
NIST Privacy Framework NISTPF-7: Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) Apply Maintenance (PR.MA-P) including system maintenance + repair with approved tools + remote maintenance with prevention of unauthorised access. Apply Protective Technology (PR.PT-P) including: audit/log records determined + maintained + reviewed + removable media protected + use restricted per policy + least functionality incorporated + communications and control networks protected + resilience mechanisms implemented (high availability + DR + business continuity).
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 294 controls across 90 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CH-FADP-02 Principles of lawful processing CH-FADP-04 Data subject access right CH-FADP-05 Data accuracy and rectification CH-FADP-19 Transparency and proactive information CH-FADP-21 Data protection impact assessments FADP-11 Duty to Inform (Article 19) FADP-12 Right of Access (Article 25) FADP-15 Data Breach Notification FADP-16 FDPIC Independence and Functions FADP-7 Data Protection Impact Assessment (Articles 9-10) FADP-9 Data Protection Advisor (Articles 14-15) GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.25 Data protection by design and by default GDPR-Art.35 Data protection impact assessment GDPR-Art.38 Position of the data protection officer GDPR-Art.9 Processing of special categories of personal data AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-12 Section 62 - Administrative penalties AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing AT-DSG-7 Section 18 - Establishment of the Data Protection Authority BB-DPA-1 Section 1 - Short Title BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-21 Sections 61-69 - Data Privacy Officer BB-DPA-4 Section 4 - Principles Relating to Processing AZ-DPA-12 Article 13 - Cross-border transfer AZ-DPA-14 Article 16 - Liability for violations AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-6 Article 6 - State regulation in personal data protection 27400-5.4 Data and privacy risks 27400-7.1 Network Security for IoT 27400-7.3 Data minimization and purpose limitation 27400-7.4 Data retention and deletion NISTSP122-4 PII Minimisation, Purpose Limitation, and Pseudonymisation NISTSP122-5 PII Security Controls - Encryption, Access Control, Storage, Audit NISTSP122-6 PII Breach Response and Incident Handling NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring PDPASG-1 Accountability, Records, DPO Appointment, and Training PDPASG-2 Notification, Consent, Purpose Limitation, and Lawful Basis PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPASG-5 Protection, Accuracy, and Security of Personal Data PDPATH-4 DPIA, Privacy by Design, Children's Data PDPATH-5 Security Measures and Data Protection PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement NORWAY-4 DPIA, Privacy by Design, Records of Processing NORWAY-5 Security of Processing, Encryption, Pseudonymization, Access Control NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework AUPRV-4 APP 10-11 Quality, Security of Personal Information AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response IM8-DAT.2 Data Protection IM8-DAT.4 Data Retention and Disposal IM8-DSS.2 Service Reliability Standards IM8-RES.4 Resilience Testing APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A33 Request for Disclosure of Retained Personal Data 4.3.2 Legal and Other Requirements 4.4.1 Resources, Roles, Responsibility, and Authority 4.4.2 Competence, Training, and Awareness APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information FFIEC-11 Business continuity planning and testing FFIEC-12 Disaster recovery procedures FFIEC-14 Critical service identification UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) ISO27799-03 Minimum necessary standard enforcement ISO27799-04 Patient data de-identification procedures ISO27799-05 Audit trail for ePHI access 27011-5.2 Information Security Roles in Telecoms 27011-6.3 Awareness and Training 27011-8.6 Data protection and backup 29100-6.10 Information security 29100-6.5 Use, retention and disclosure limitation 29100-6.9 Accountability 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure NIST-CSF-PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected NIST-CSF-PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations NIST-CSF-PR.IR-04 Adequate resource capacity to ensure availability is maintained PCI-P2PE-11 Business continuity planning and testing PCI-P2PE-12 Disaster recovery procedures PCI-P2PE-14 Critical service identification PCI-PIN-13 Third-party dependency management PCI-PIN-14 Critical service identification PCI-PIN-15 Communication and escalation procedures PCI-SSF-12 Disaster recovery procedures PCI-SSF-14 Critical service identification PCI-SSF-15 Communication and escalation procedures POPIASA-3 Data Subject Rights (Access, Correction, Objection), Automated Decisions POPIASA-4 Special Personal Information, Children, Information Quality, Documentation POPIASA-7 Information Officer, Records of Processing, Notification, Training PAKPDPB-6 Cross-Border Transfer and Data Localization PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training PERU-2 Consent, Privacy Notice, Sensitive Data PERU-3 Data Subject Rights (ARCO), Habeas Data, Automated Decisions PERU-5 Security of Personal Data and Processor Agreements NZPRV-2 IPP 5 Storage and Security of Personal Information NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training ISMSP-PI-01 Personal Information Collection ISMSP-PI-04 Cross-Border Transfer ISMSP-SYS-02 Encryption Implementation OB-API.4 MI Reporting Specification OB-CX.2 Granular Consent Management OB-OPS.1 API Availability Requirements CPS234-14 Definition of Information Security Roles and Responsibilities CPS234-15 Information Security Capability ASD37-20 Multi-factor authentication (Essential) ASD37-27 Outbound data loss prevention (Very Good) AL-DPA-12 International Data Transfers AL-DPA-14 Direct Marketing FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) 62351-12 Resilience and security recommendations for DER 62351-13 Cyber-physical generation and storage resilience 27031-8.1 Exercising and Testing 27031-B High availability embedded systems 27557-3 Terms and definitions 27557-4.3 Individual impact consideration NISTSP144-3 Data Classification, Handling, and Sovereignty NISTSP144-5 Identity and Access in Cloud, Federation, and Privileged Access NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-6 Cloud Security and Privacy Recommendations NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection NDPA-1 Applicability, Scope, and Carve-Outs NDPA-4 Sensitive Data Processing Consent and Childrens Protections OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation OSFIB13-4 Third-Party Risk Management and Cloud OSFIB13-7 Incident Reporting to OSFI and Regulatory Coordination OPENBANK-4 Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM RUSPD-1 Scope, Definitions, Principles under 152-FZ RUSPD-4 Special Categories, Biometric Data SAPAIA-2 Right of Access and Request Processes SAPAIA-4 Information Regulator Cooperation and Appeals TURKEYKVKK-2 Information Notice and Data Subject Rights TURKEYKVKK-3 Special Categories and Sensitive Data USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-2 Personal Information Protection and Consumer Protection VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-4 Incident Reporting and Cooperation VIETNAMPDP-1 Scope, Categorisation, Lawful Basis VIETNAMPDP-3 Data Subject Rights AWWA-3.4 Encryption and Data Protection DS-2 Ensure software supply chain security BS65000-RM-03 Leadership and Culture CPG-3.C Strong and Agile Encryption COBIT-BAI04 Managed availability and capacity CA-10 Selects and Develops Control Activities CAT-D5-4 Resilience planning and testing ISO-26000-6.7 Consumer issues ISO20000-03 Capacity and availability management ISO23894-A.5 Privacy and Data Protection in AI ISO-25012-4.13 Availability 27007-5.4 Establishing the Programme Resources ITIL4-03 Capacity and availability management NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02) OMANCS-4 Data Protection, Cryptography, and Privacy Alignment PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out) KRCSAP-1 CSAP Certification Tiers (IaaS, SaaS, DaaS, AI) TEFCAREC-1 Common Agreement Conformance and Onboarding D.1 Incident Response Planning CPSC-CS.3 Data Protection for Safety Systems CERT-1 RRA Certification to EPA Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 294 it maps to, and the evidence behind each claim, over MCP and REST.