How does physical security relate to the Protect function?
- A.Only data centers need physical security, and it presupposes that roles and responsibilities belong only to Protect and that the Protect function excludes physical and environmental safeguards
- B.Physical security only protects against natural disasters, because facility power and HVAC resilience are outside the Framework's PROTECT outcomes; beyond that, underspending against the action plan triggers removal from NIST's adopter listing
- C.Physical security controls (locks, cameras, access badges, environmental controls) protect hardware, facilities, and physical assets from unauthorized access, theft, and environmental damage
- D.Physical security is not part of the NIST CSF
Why C is correct
Physical security protects the tangible assets that host data and systems. Without physical protection, technical controls can be bypassed through physical access.
Know someone studying for NIST CSF? Send them this one.