Platform Security (PR.PS) — NIST CSF 2.0 Category

Category outcome

NIST CSF 2.0 places Platform Security (PR.PS) within the Protect Function. The official Category outcome is: “The hardware, software, and services of physical and virtual platforms are managed consistent with the organization’s risk strategy to protect their confidentiality, integrity, and availability.”

This Category provides a structured way to address configuration, maintenance, logs, software control, secure development, and platform life cycle. It groups related Subcategory outcomes without prescribing a specific technology, organizational model, or implementation sequence.

What this means in practice

A credible Platform Security capability connects policy and risk decisions to repeatable operating practices. The organization should define scope, ownership, expected outcomes, evidence, exceptions, and reassessment triggers.

Implementation should be proportionate to mission needs, legal and contractual obligations, threat exposure, business impact, and the organization’s risk appetite. The same Category may be implemented differently across systems and business contexts.

Implementation priorities

The following priorities translate the Category into an operating capability. They are starting points for design and governance, not a replacement for architecture, procedures, or risk analysis.

• Define secure configurations for supported platforms and services.
• Maintain software and hardware within approved support and risk thresholds.
• Generate protected logs that support operations, detection, and assurance.
• Prevent unauthorized software installation and execution.
• Integrate secure development and supply chain practices throughout software life cycles.

Evidence and measurement

Evidence should show that the Category’s outcomes are achieved in the intended scope, remain effective, and are reviewed when conditions change. A policy, tool purchase, or completed checklist is not sufficient by itself.

• Platform baselines and configuration-compliance results
• Patch, maintenance, and end-of-life records
• Logging standards, telemetry health, and retention evidence
• Application-control and software inventory records
• Secure development, testing, provenance, and release evidence

Subcategories within PR.PS

This Category contains 6 CSF 2.0 Subcategory outcomes. Each outcome has a dedicated Bare Metal Cyber profile with the official NIST statement and original implementation guidance.

• PR.PS-01 — Configuration Management: Configuration management practices are established and applied
• PR.PS-02 — Software Maintenance and Removal: Software is maintained, replaced, and removed commensurate with risk
• PR.PS-03 — Hardware Maintenance and Removal: Hardware is maintained, replaced, and removed commensurate with risk
• PR.PS-04 — Generate and Provide Log Records: Log records are generated and made available for continuous monitoring
• PR.PS-05 — Prevent Unauthorized Software: Installation and execution of unauthorized software are prevented
• PR.PS-06 — Secure Software Development: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

Using this Category in Current and Target Profiles

For a Current Profile, record which Subcategory outcomes are achieved, the scope of the assessment, and the evidence supporting the judgment. For a Target Profile, select the outcomes needed to meet risk management objectives and describe the target conditions.

Prioritize the resulting gaps by mission consequence, risk exposure, dependencies, obligations, implementation effort, and the value of the improvement. Record the owner and the evidence that will demonstrate closure.

Common failure modes

The following conditions can create the appearance of coverage without reliable outcome achievement. Treat them as hypotheses to test during assessments, exercises, and operational reviews.

• Baselines exist but are not measured against deployed systems.
• Unsupported hardware or software persists without owned risk decisions.
• Logs are generated but incomplete, unprotected, or unusable.
• Development controls stop at production release and ignore maintenance or dependencies.

Source, scope, and attribution

The Category identifier, name, description, and Subcategory outcomes are from NIST CSWP 29. Bare Metal Cyber’s implementation, evidence, failure-mode, and Profile guidance is original educational material.

The CSF describes outcomes, not mandatory implementation steps. Use NIST’s current online Implementation Examples and Informative References when selecting practices and controls for a specific environment.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Authoritative sources

• NIST Cybersecurity Framework (CSF) 2.0 — NIST CSWP 29
• NIST Cybersecurity Framework Resource Center
• NIST CSF 2.0 Reference Tool
• NIST CSF 2.0 Organizational Profiles