NIST Privacy Framework v1.0

Why does it matter?

The Privacy Framework exists because managing cybersecurity risk is not enough to manage privacy risk. Section 1.2.1 explains that privacy risks can arise from data processing that works as intended, such as smart meters revealing household behavior, and not only from breaches. By tying problems individuals experience to organizational impacts such as noncompliance costs, customer abandonment and reputational harm, the framework lets privacy sit beside other enterprise risks. Its executive summary names three uses: building customer trust, meeting current and future compliance obligations, and communicating about privacy practices with individuals, partners, assessors and regulators.

Key benefits include:

• Privacy risk in enterprise terms

Section 1.2.1 connects problematic data actions to organizational impacts, bringing privacy risk into parity with the rest of the risk portfolio.

• Beyond compliance

Section 1.2.2 notes that a privacy risk assessment can show problems for individuals even where an organization is fully compliant with applicable law.

• Profiles instead of a checklist

Section 2.2 prescribes no Profile template, so an organization selects and tailors the Functions, Categories and Subcategories to its own needs.

• A shared vocabulary

The framework gives executives, legal teams and IT a common language, with a Figure 7 flow of collaboration from the senior executive level to operations.

• Support for supplier and buying decisions

Sections 3.5 and 3.6 show how Profiles express privacy requirements to service providers and inform buying decisions.

How does it work?

Section 3.3 describes a simple three-phase method for a new or improved privacy program. In Ready, an organization uses Identify-P and Govern-P to understand its legal environment, risk tolerance and data processing, and starts its Current and Target Profiles. In Set, it completes the Current Profile, finishes the Target Profile, compares them and writes a prioritized action plan. In Go, it carries out that plan. The phases can be repeated in any order.

The Core's Functions are not a serial path to a static end state; section 2.1 says they should be performed concurrently and continuously. Protect-P covers cybersecurity-related privacy events, the overlap with cybersecurity risk. An organization can pair Protect-P with the Cybersecurity Framework's Detect, Respond and Recover Functions, or use all five Cybersecurity Framework Functions beside Identify-P, Govern-P, Control-P and Communicate-P.

A Current Profile records the privacy outcomes an organization achieves today and a Target Profile records those it needs, and the gap becomes the action plan (section 2.2). Tiers (section 2.3) give a reference point for whether processes and resources are sufficient. The document says that successful implementation rests on achieving the Target Profile outcomes, not on reaching any particular Tier, and that not every organization needs Tier 3 or 4.

Key Elements

• Identify-P (ID-P)

Four Categories: Inventory and Mapping, Business Environment, Risk Assessment, and Data Processing Ecosystem Risk Management, including eight inventory Subcategories from systems to data elements.

• Govern-P (GV-P)

Four Categories: Governance Policies, Processes, and Procedures; Risk Management Strategy; Awareness and Training; and Monitoring and Review.

• Control-P (CT-P)

Three Categories: Data Processing Policies, Processes, and Procedures; Data Processing Management; and Disassociated Processing.

• Communicate-P (CM-P)

Two Categories: Communication Policies, Processes, and Procedures, and Data Processing Awareness.

• Protect-P (PR-P)

Five Categories: Data Protection Policies; Identity Management, Authentication, and Access Control; Data Security; Maintenance; and Protective Technology.

• Profiles and Tiers (2.2, 2.3, Appendix E)

Current and Target Profiles, and the four Implementation Tiers: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4).

What does it cover?

Section 1.0 intends the framework to be usable by organizations of all sizes and agnostic to any technology, sector, law or jurisdiction. It covers data processing, the set of data actions such as collection, retention, logging, generation, transformation, use, disclosure, sharing, transmission and disposal, in digital or non-digital form. Section 3.5 places each organization in the data processing ecosystem, whose notional roles include developers, manufacturers, suppliers and service providers, business partners, public services and the individuals themselves.

What are its objectives?

Section 1.0 gives the purpose: to help organizations manage privacy risks in three ways.

Take privacy into account as they design and deploy systems, products and services that affect individuals.

Communicate about their privacy practices with individuals, partners and regulators.

Encourage workforce collaboration among executives, legal and IT through Profiles, Tiers and outcomes.

Bring privacy risk into parity with the wider enterprise risk portfolio.

Support the privacy engineering objectives of predictability, manageability and disassociability described in Appendix D.

Framework in Context

The Privacy Framework was modeled on the Cybersecurity Framework, and its own references cite Version 1.1 of that framework; NIST's Version 1.1 draft aims to realign it with CSF 2.0. Section 3.1 explains that informative references map standards, laws and regulations to Subcategories, so one Profile can serve several legal regimes. The framework is not a privacy law and does not replace one. It sits beside NIST's Privacy Risk Assessment Methodology and NIST IR 8062 on privacy engineering, both of which it cites, and NIST maintains a Resource Repository of implementation tools.

Common Framework Mappings

Informative references (section 3.1) map the Core's Subcategories to standards, laws, regulations and practices, and NIST hosts crosswalks in its Resource Repository. The frameworks below are those organizations most often cross-walk to a Privacy Framework Profile.

Mapped frameworks include:

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27701

ISO 29100

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2