Under the NIST Cybersecurity Framework, which of the following actions is categorized under the Protect (PR) function? Select ALL that apply.

### Why this is right - **Improve and measure the cybersecurity awareness programme** is correct because staff awareness and training are part of Protect. - **Develop tools to categorise sensitive data** is correct because classification supports appropriate handling and security. - **Implement technology to detect and prevent data loss** is correct because data security and protective technology are Protect concerns. ### The concept Protect initiatives aim to reduce the chance or impact of unauthorised access, misuse, or loss. They may combine staff education, information-handling processes, and technical safeguards. Vendor risk assessment is a separate Identify and Manage initiative because it evaluates external dependencies. ### The other options - **D. Create a vendor risk assessment process**: this supports supply-chain risk management rather than the Protect initiatives listed here. ### Terms - **Sensitive data**: information that needs special handling because disclosure or misuse could cause harm. ### Remember Protect initiatives safeguard information; supplier assessment identifies and manages external risk.