Law / Frameworks / NIST Privacy Framework / Protect-P
NIST Privacy Framework, Protect-PPR.PT-P2
The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.NIST Privacy Framework, version 1.0, January 2020, PR.PT-P2
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 2
- laws
- 2
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST CSF 2.0PR.PS-01 Configuration management practices are established and applied, 2 laws
Product security requirements
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Brazil |
Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment) |
Do not hard-code credentials or cryptographic keys in the device's software or firmware source code, encrypt or hash any password, key, or credential you store or transmit, implement inactive-session timeouts, ship with unused communication ports and services disabled, and let the user disable non-essential communication features. |
Sector security regimes
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 New York |
New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management |
Disable or securely configure all protocols that permit remote control of devices. |
Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.