diff --git a/src/drivers/spi/spi_flash.c b/src/drivers/spi/spi_flash.c
index 2dd616bb65..1b00078d5d 100644
--- a/src/drivers/spi/spi_flash.c
+++ b/src/drivers/spi/spi_flash.c
@@ -459,3 +459,29 @@ void lb_spi_flash(struct lb_header *header)
 		flash->erase_cmd = CMD_BLOCK_ERASE;
 	}
 }
+
+
+int spi_flash_ctrlr_protect_region(const struct spi_flash *flash,
+					const struct region *region)
+{
+	const struct spi_ctrlr *ctrlr;
+	struct region flash_region = { 0 };
+
+	if (!flash)
+		return -1;
+
+	flash_region.size = flash->size;
+
+	if (!region_is_subregion(&flash_region, region))
+		return -1;
+
+	ctrlr = flash->spi.ctrlr;
+
+	if (!ctrlr)
+		return -1;
+
+	if (ctrlr->flash_protect)
+		return ctrlr->flash_protect(flash, region);
+
+	return -1;
+}
diff --git a/src/include/spi-generic.h b/src/include/spi-generic.h
index 783df0b917..a3298f8376 100644
--- a/src/include/spi-generic.h
+++ b/src/include/spi-generic.h
@@ -16,6 +16,7 @@
 #ifndef _SPI_GENERIC_H_
 #define _SPI_GENERIC_H_
 
+#include <commonlib/region.h>
 #include <stdint.h>
 #include <stddef.h>
 
@@ -115,6 +116,7 @@ struct spi_flash;
  *
  * flash_probe:	Specialized probe function provided by SPI flash
  *			controllers.
+ * flash_protect: Protect a region of flash using the SPI flash controller.
  */
 struct spi_ctrlr {
 	int (*claim_bus)(const struct spi_slave *slave);
@@ -128,6 +130,8 @@ struct spi_ctrlr {
 	bool deduct_cmd_len;
 	int (*flash_probe)(const struct spi_slave *slave,
 				struct spi_flash *flash);
+	int (*flash_protect)(const struct spi_flash *flash,
+				const struct region *region);
 };
 
 /*-----------------------------------------------------------------------
diff --git a/src/include/spi_flash.h b/src/include/spi_flash.h
index e9ea50c4d2..3a6df9ab1f 100644
--- a/src/include/spi_flash.h
+++ b/src/include/spi_flash.h
@@ -120,4 +120,9 @@ int chipset_volatile_group_end(const struct spi_flash *flash);
  * if CONFIG_BOOT_DEVICE_SPI_FLASH is enabled. */
 const struct spi_flash *boot_device_spi_flash(void);
 
+/* Protect a region of spi flash using its controller, if available. Returns
+ * < 0 on error, else 0 on success. */
+int spi_flash_ctrlr_protect_region(const struct spi_flash *flash,
+					const struct region *region);
+
 #endif /* _SPI_FLASH_H_ */