A protected configuration space is implemented as at least one range of memory addresses that are mapped to logic external to system memory. The memory addresses access logic that performs control and status operations pertaining to a protected operating environment. Some of the addresses may access protected configuration registers. Commands having destination addresses within the protected configuration space may not be completed if the commands are not issued by a processor, or if the commands are not part of a group of one or more designated protected commands. A separately addressable non-protected configuration space may also be implemented, accessible by processors, non-processors and/or non-protected commands.