Version 1.0

NIST PRIVACY FRAMEWORK: A TOOL FOR
IMPROVING PRIVACY THROUGH ENTERPRISERISK MANAGEMENT, VERSION 1.0
January 16, 2020

This publication is available free of charge from:https://doi.org/10.6028/NIST.CSWP.01162020

The contents of this document do not have the force and effect oflaw and are not meant to bind the public in any way.

NIST Privacy Framework

January 16, 2020

Executive Summary
For more than two decades, the Internet and associated information technologies have driven
unprecedented innovation, economic value, and improvement in social services. Many of these benefits
are fueled by data about individuals that flow through a complex ecosystem. As a result, individuals may
not be able to understand the potential consequences for their privacy as they interact with systems,
products, and services. At the same time, organizations may not realize the full extent of these
consequences for individuals, for society, or for their enterprises, which can affect their brands, theirbottom lines, and their future prospects for growth.
Following a transparent, consensus-based process including both private and public stakeholders to
produce this voluntary tool, the National Institute of Standards and Technology (NIST) is publishing thisPrivacy Framework: A Tool for Improving Privacy through Enterprise Risk Management (Privacy
Framework), to enable better privacy engineering practices that support privacy by design concepts andhelp organizations protect individuals’ privacy. The Privacy Framework can support organizations in:•

Building customers’ trust by supporting ethical decision-making in product and service design or
deployment that optimizes beneficial uses of data while minimizing adverse consequences forindividuals’ privacy and society as a whole; 1•

Fulfilling current compliance obligations, as well as future-proofing products and services tomeet these obligations in a changing technological and policy environment; and•Facilitating communication about privacy practices with individuals, business partners,
assessors, and regulators.

Deriving benefits from data while simultaneously managing risks to individuals’ privacy is not well-suited
to one-size-fits-all solutions. Like building a house, where homeowners make layout and design choices
while relying on a well-engineered foundation, privacy protection should allow for individual choices, aslong as effective privacy risk mitigations are already engineered into products and services. The Privacy
Framework—through a risk- and outcome-based approach—is flexible enough to address diverse
privacy needs, enable more innovative and effective solutions that can lead to better outcomes forindividuals and organizations, and stay current with technology trends, such as artificial intelligence andthe Internet of Things.
The Privacy Framework follows the structure of the Framework for Improving Critical Infrastructure
Cybersecurity (Cybersecurity Framework) [1] to facilitate the use of both frameworks together. Like the
Cybersecurity Framework, the Privacy Framework is composed of three parts: Core, Profiles, andImplementation Tiers. Each component reinforces privacy risk management through the connection
between business and mission drivers, organizational roles and responsibilities, and privacy protection
activities.

1•

The Core enables a dialogue—from the executive level to the implementation/operations
level—about important privacy protection activities and desired outcomes.

•

Profiles enable the prioritization of the outcomes and activities that best meet organizational
privacy values, mission or business needs, and risks.

There is no objective standard for ethical decision-making; it is grounded in the norms, values, and legal
expectations in a given society.

iNIST Privacy Framework•

January 16, 2020

Implementation Tiers support decision-making and communication about the sufficiency oforganizational processes and resources to manage privacy risk.

In summary, the Privacy Framework is intended to help organizations build better privacy foundations
by bringing privacy risk into parity with their broader enterprise risk portfolio.

Acknowledgements
This publication is the result of a collaborative effort between NIST and organizational and individual
stakeholders in the public and private sectors. In developing the Privacy Framework, NIST has relied
upon three public workshops, a request for information (RFI), a request for comment (RFC), fivewebinars, and hundreds of direct interactions with stakeholders. 2 NIST acknowledges and thanks all of
those who have contributed to this publication.

2

A complete development archive can be found at https://www.nist.gov/privacy-framework.

ii

NIST Privacy Framework

January 16, 2020

Table of Contents
Executive Summary ............................................................................................................................... i
Acknowledgements.............................................................................................................................. ii
1.0

Privacy Framework Introduction.......................................................................................... 1

Overview of the Privacy Framework ...................................................................................................... 2
Privacy Risk Management ...................................................................................................................... 2
1.2.1
Cybersecurity and Privacy Risk Management ................................................................................... 3
1.2.2
Privacy Risk Assessment.................................................................................................................... 4
Document Overview .............................................................................................................................. 5

2.0

Privacy Framework Basics .................................................................................................... 6

3.0

How to Use the Privacy Framework ..................................................................................... 9Core........................................................................................................................................................ 6
Profiles ................................................................................................................................................... 8
Implementation Tiers ............................................................................................................................ 8
Mapping to Informative References ...................................................................................................... 9Strengthening Accountability .............................................................................................................. 10
Establishing or Improving a Privacy Program ...................................................................................... 11
Applying to the System Development Life Cycle ................................................................................. 12
Using within the Data Processing Ecosystem ...................................................................................... 13
Informing Buying Decisions ................................................................................................................. 14

References ......................................................................................................................................... 15
Appendix A: Privacy Framework Core ................................................................................................. 17
Appendix B: Glossary ......................................................................................................................... 28
Appendix C: Acronyms ....................................................................................................................... 31
Appendix D: Privacy Risk Management Practices ............................................................................... 32
Appendix E: Implementation Tiers Definitions .................................................................................... 37

List of Figures
Figure 1: Core, Profiles, and Implementation Tiers.............................................................................................. 2
Figure 2: Cybersecurity and Privacy Risk Relationship ......................................................................................... 3
Figure 3: Relationship Between Privacy Risk and Organizational Risk .................................................................. 4
Figure 4: Privacy Framework Core Structure ....................................................................................................... 6
Figure 5: Using Functions to Manage Cybersecurity and Privacy Risks ................................................................. 7
Figure 6: Relationship Between Core and Profiles ............................................................................................... 8
Figure 7: Notional Collaboration and Communication Flows Within an Organization.......................................... 10
Figure 8: Data Processing Ecosystem Relationships ............................................................................................ 13

List of Tables
Table 1: Privacy Framework Function and Category Unique Identifiers .............................................................. 19
Table 2: Privacy Framework Core ...................................................................................................................... 20
Table 3: Privacy Engineering and Security Objectives ......................................................................................... 34

iii

NIST Privacy Framework

January 16, 2020

1.0 Privacy Framework Introduction
For more than two decades, the Internet and associated information technologies have driven
unprecedented innovation, economic value, and access to social services. Many of these benefits are
fueled by data about individuals that flow through a complex ecosystem. As a result, individuals may not
be able to understand the potential consequences for their privacy as they interact with systems,
products, and services. Organizations may not fully realize the consequences either. Failure to manage
privacy risks can have direct adverse consequences at both the individual and societal levels, withfollow-on effects on organizations’ brands, bottom lines, and future prospects for growth. Finding ways
to continue to derive benefits from data processing while simultaneously protecting individuals’ privacy
is challenging, and not well-suited to one-size-fits-all solutions.
Privacy is challenging because not only is it an all-encompassing concept that helps to safeguard
important values such as human autonomy and dignity, but also the means for achieving it can vary. 3
For example, privacy can be achieved through seclusion, limiting observation, or individuals’ control offacets of their identities (e.g., body, data, reputation). 4 Moreover, human autonomy and dignity are not
fixed, quantifiable constructs; they are filtered through cultural diversity and individual differences. This
broad and shifting nature of privacy makes it difficult to communicate clearly about privacy risks within
and between organizations and with individuals. What has been missing is a common language andpractical tool that is flexible enough to address diverse privacy needs.
This voluntary NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk
Management (Privacy Framework) is intended to be widely usable by organizations of all sizes andagnostic to any particular technology, sector, law, or jurisdiction. Using a common approach—adaptable
to any organization’s role(s) in the data processing ecosystem—the Privacy Framework’s purpose is tohelp organizations manage privacy risks by:

3
4•

Taking privacy into account as they design and deploy systems, products, and services that
affect individuals;•

Communicating about their privacy practices; and•Encouraging cross-organizational workforce collaboration—for example, among executives,
legal, and information technology (IT)—through the development of Profiles, selection of Tiers,
and achievement of outcomes.

Autonomy and dignity are concepts covered in the United Nations Universal Declaration of Human Rights at
https://www.un.org/en/universal-declaration-human-rights/.
There are many publications that provide an in-depth treatment on the background of privacy or different
aspects of the concept. For two examples, see Solove D (2010) Understanding Privacy (Harvard University
Press, Cambridge, MA), https://ssrn.com/abstract=1127888; and Selinger E, Hartzog W (2017) Obscurity andPrivacy, Spaces for the Future: A Companion to Philosophy of Technology, eds Pitt J, Shew A (Taylor & Francis,
New York, NY), Chapter 12, 1st Ed., https://doi.org/10.4324/9780203735657.

1

NIST Privacy Framework

January 16, 2020

Overview of the Privacy Framework
As shown in Figure 1, the Privacy
Framework is composed of threeparts: Core, Profiles, andImplementation Tiers. Eachcomponent reinforces howorganizations manage privacy risk
through the connection between
business or mission drivers,
organizational roles andresponsibilities, and privacy
protection activities. As further
explained in section 2:

The Core provides an increasingly granular setof activities and outcomes that enable anorganizational dialogue about managing privacy
risk

CURRENTTARGET

Profiles are a selection of
specific Functions,Categories, andSubcategories from theCore that an organization
has prioritized to help it
manage privacy risk•

The Core is a set of privacy
protection activities and
Implementation Tiers support communication
outcomes that allows forabout whether an organization has sufficient
processes and resources in place to manage
communicating prioritizedprivacy risk and achieve its Target Profile
privacy protection
activities and outcomes
Figure 1: Core, Profiles, and Implementation Tiers
across an organization from theexecutive level to the implementation/operations level. The Core is further divided into key
Categories and Subcategories—which are discrete outcomes—for each Function.

•

A Profile represents an organization’s current privacy activities or desired outcomes. To develop
a Profile, an organization can review all of the outcomes and activities in the Core to determine
which are most important to focus on based on business or mission drivers, data processing
ecosystem role(s), types of data processing, and individuals’ privacy needs. An organization cancreate or add Functions, Categories, and Subcategories as needed. Profiles can be used to
identify opportunities for improving privacy posture by comparing a “Current” Profile (the “asis” state) with a “Target” Profile (the “to be” state). Profiles can be used to conduct selfassessments and to communicate within an organization or between organizations about how
privacy risks are being managed.

•

Implementation Tiers (“Tiers”) provide a point of reference on how an organization views
privacy risk and whether it has sufficient processes and resources in place to manage that risk.
Tiers reflect a progression from informal, reactive responses to approaches that are agile andrisk informed. When selecting Tiers, an organization should consider its Target Profile(s) andhow achievement may be supported or hampered by its current risk management practices, thedegree of integration of privacy risk into its enterprise risk management portfolio, its dataprocessing ecosystem relationships, and its workforce composition and training program.

Privacy Risk Management
While some organizations have a robust grasp of privacy risk management, a common understanding ofmany aspects of this topic is still not widespread. 5 To promote broader understanding, this section
covers concepts and considerations that organizations may use to develop, improve, or communicate
5

See Summary Analysis of the Responses to the NIST Privacy Framework Request for Information [2] at p. 7.

2

NIST Privacy Framework

January 16, 2020

about privacy risk management. Appendix D provides additional information on key privacy risk
management practices.

1.2.1

Cybersecurity and Privacy Risk Management

Since its release in 2014, the Cybersecurity
Framework has helped organizations tocommunicate and manage cybersecurity
risk. [1] While managing cybersecurity
risk contributes to managing privacy risk,
it is not sufficient, as privacy risks canalso arise by means unrelated tocybersecurity incidents, as illustrated by
Figure 2. Having a general understandingof the different origins of cybersecurity
and privacy risks is important for
determining the most effective solutions toaddress the risks.

Cybersecurity
Risks
cyber
associated withsecuritycybersecurity
relatedincidents arising from privacy
loss of confidentiality, events
integrity, oravailability

PrivacyRisks
associated withprivacy events
arising from dataprocessing

Figure 2: Cybersecurity and Privacy Risk
Relationship

The Privacy Framework approach to privacy
risk is to consider privacy events as potential problems individuals could experience arising from system,
product, or service operations with data, whether in digital or non-digital form, through a complete life
cycle from data collection through disposal.
The Privacy Framework describes these data operations in the singular as a data action and collectively
as data processing. The problems individuals can experience as a result of dataprocessing can be expressed in various ways, but NIST describes them as
Data Action
ranging from dignity-type effects such as embarrassment or stigmas to more
A data life cycle
operation, including,tangible harms such as discrimination, economic loss, or physical harm. 6
but not limited tocollection, retention,
logging, generation,transformation, use,
disclosure, sharing,transmission, anddisposal.
Data Processing
The collective set ofdata actions.

6

7

8

The basis for the problems that individuals may experience can vary. As
depicted in Figure 2, problems arise as an adverse effect of data processingthat organizations conduct to meet their mission or business objectives. An
example is the concerns that certain communities had about the installation of“smart meters” as part of the Smart Grid, a nationwide technological effort toincrease energy efficiency. 7 The ability of these meters to collect, record, anddistribute highly granular information about household electrical use could
provide insight into people’s behavior inside their homes. 8 The meters were

NIST has created an illustrative catalog of problems for use in privacy risk assessment. See NIST Privacy Risk
Assessment Methodology [3]. Other organizations may have created other categories of problems, or may
refer to them as adverse consequences or harms.
See, for example, NIST Interagency or Internal Report (IR) 7628 Revision 1 Volume 1, Guidelines for Smart Grid
Cybersecurity: Volume 1 – Smart Grid Cybersecurity Strategy, Architecture, and High-Level Requirements at [4]p. 26.
See NIST IR 8062, An Introduction to Privacy Engineering and Risk Management in Federal Systems at [5] p. 2.
For additional types of privacy risks associated with adverse effects on individuals of data processing, see
Appendix E of NIST IR 8062.

3

NIST Privacy Framework

January 16, 2020

operating as intended, but the data processing could lead to people feeling surveilled.
In an increasingly connected world, some problems can arise simply from individuals’ interactions withsystems, products, and services, even when the data being processed is not directly linked to identifiable
individuals. For example, smart cities technologies could be used to alter or influence people’s behavior
such as where or how they move through the city. 9 Problems also can arise where there is a loss ofconfidentiality, integrity, or availability at some point in the data processing, such as data theft byexternal attackers or the unauthorized access or use of data by employees. Figure 2 shows these typesof cybersecurity-related privacy events as the overlap between privacy and cybersecurity risks.
Once an organization can identify the likelihood of any given problem arising from the data processing,which the Privacy Framework refers to as a problematic data action, it can assess the impact should the
problematic data action occur. This impact assessment is where privacy risk and organizational riskintersect. Individuals, whether singly or in groups (including at a societal level) experience the direct
impact of problems. As a result of the problems individuals experience, an organization may experience
impacts such as noncompliance costs, revenue loss arising from customer abandonment of products andservices, or harm to its external brand reputation or internal culture. Organizations commonly manage
these types of impacts at the enterprise risk management level; by connecting problems that individuals
experience to these well-understood organizational impacts, organizations can bring privacy risk into
parity with other risks they are managing in their broader portfolio and drive more informed decisionmaking about resource allocation to strengthen privacy programs. Figure 3 illustrates this relationshipbetween privacy risk and organizational risk.

Problemarises from dataprocessing

Individual
experiences direct impact(e.g., embarrassment,
discrimination, economic
loss)

Organization
resulting impact(e.g., customer abandonment,
noncompliance costs, harm to
reputation or internal culture)

Figure 3: Relationship Between Privacy Risk and Organizational Risk

1.2.2 Privacy Risk Assessment
Privacy risk management is a cross-organizational set of processes that helps organizations tounderstand how their systems, products, and services may create problems for individuals and how todevelop effective solutions to manage such risks. Privacy risk assessment is a sub-process for identifying
and evaluating specific privacy risks. In general, privacy risk assessments produce the information that
can help organizations to weigh the benefits of the data processing against the risks and to determine
the appropriate response—sometimes referred to as proportionality. 10 Organizations may choose to

910

See Newcombe T (2016) Security, Privacy, Governance Concerns About Smart City Technologies Grow.
Government Technology. Available at http://www.govtech.com/Security-Privacy-Governance-Concerns-AboutSmart-City-Technologies-Grow.html.
See European Data Protection Supervisor (2019) Necessity & Proportionality. Available athttps://edps.europa.eu/data-protection/our-work/subjects/necessity-proportionality_en.

4

NIST Privacy Framework

January 16, 2020prioritize and respond to privacy risk in different ways, depending on the potential impact to individuals
and resulting impacts to organizations. Response approaches include: 11•

Mitigating the risk (e.g., organizations may be able to apply technical and/or policy measures tothe systems, products, or services that minimize the risk to an acceptable degree);•Transferring or sharing the risk (e.g., contracts are a means of sharing or transferring risk toother organizations, privacy notices and consent mechanisms are a means of sharing risk withindividuals);•

Avoiding the risk (e.g., organizations may determine that the risks outweigh the benefits, andforego or terminate the data processing); or•

Accepting the risk (e.g., organizations may determine that problems for individuals are minimalor unlikely to occur, therefore the benefits outweigh the risks, and it is not necessary to invest
resources in mitigation).

Privacy risk assessments are particularly important because, as noted above, privacy is a condition thatsafeguards multiple values. The methods for safeguarding these values may differ, and moreover, may
be in tension with each other. Depending on its objectives, if an organization is trying to achieve privacy
by limiting observation, this may lead to implementing measures such as distributed data architectures
or privacy-enhancing cryptographic techniques that hide data even from the organization. If anorganization is also trying to enable individual control, the measures could conflict. For example, if an
individual requests access to data, the organization may not be able to produce the data if the data havebeen distributed or encrypted in ways the organization cannot access. Privacy risk assessments can help
an organization understand in a given context the values to protect, the methods to employ, and how tobalance implementation of different types of measures.
Lastly, privacy risk assessments help organizations distinguish between privacy risk and compliance risk.
Identifying if data processing could create problems for individuals, even when an organization may befully compliant with applicable laws or regulations, can help with ethical decision-making in system,
product, and service design or deployment. Although there is no objective standard for ethical decisionmaking, it is grounded in the norms, values, and legal expectations in a given society. This facilitates
optimizing beneficial uses of data while minimizing adverse consequences for individuals’ privacy andsociety as a whole, as well as avoiding losses of trust that damage organizations’ reputations, slow
adoption, or cause abandonment of products and services.
See Appendix D for more information on the operational aspects of privacy risk assessment.

Document Overview
The remainder of this document contains the following sections and appendices:

11•

Section 2 describes the Privacy Framework components: Core, Profiles, and Implementation
Tiers.

•

Section 3 presents examples of how the Privacy Framework can be used.

•

The References section lists the references for the document.

See NIST Special Publication (SP) 800-39, Managing Information Security Risk: Organization, Mission, andInformation System View [6].

5NIST Privacy Framework

January 16, 2020•

Appendix A presents the Privacy Framework Core in a tabular format: Functions, Categories,
and Subcategories.

•

Appendix B contains a glossary of selected terms.

•

Appendix C lists acronyms used in this document.

•

Appendix D considers key practices that contribute to successful privacy risk management.

•

Appendix E defines the Implementation Tiers.

2.0 Privacy Framework Basics
The Privacy Framework provides a common language for understanding, managing, and communicating
privacy risk with internal and external stakeholders. It is adaptable to any organization’s role(s) in thedata processing ecosystem. It can be used to help identify and prioritize actions for reducing privacy risk,
and it is a tool for aligning policy, business, and technological approaches to managing that risk.

Core
Set forth in Appendix A, the Core
provides an increasingly granular set of
activities and outcomes that enable a
dialogue about managing privacy risk.
As depicted in Figure 4, the Core
comprises Functions, Categories, andSubcategories.
The Core elements work together:

FUNCTIONSCATEGORIESSUBCATEGORIES

Identify-P
Govern-P
Control-P
Communicate-P•

Functions organize
Protect-P
foundational privacy activities
at their highest level. They aid
Figure 4: Privacy Framework Core Structure
an organization in expressing its
management of privacy risk by understanding and managing data processing, enabling risk
management decisions, determining how to interact with individuals, and improving by learningfrom previous activities. They are not intended to form a serial path or lead to a static desiredend state. Rather, the Functions should be performed concurrently and continuously to form or
enhance an operational culture that addresses the dynamic nature of privacy risk.

•

Categories are the subdivisions of a Function into groups of privacy outcomes closely tied toprogrammatic needs and particular activities.

•

Subcategories further divide a Category into specific outcomes of technical and/or management
activities. They provide a set of results that, while not exhaustive, help support achievement of
the outcomes in each Category.

The five Functions, Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P, defined below, canbe used to manage privacy risks arising from data processing. 12 Protect-P is specifically focused on
managing risks associated with cybersecurity-related privacy events (e.g., privacy breaches). The
Cybersecurity Framework, although intended to cover all types of cybersecurity incidents, can be
12

The “-P” at the end of each Function name indicates that it is from the Privacy Framework in order to avoid
confusion with Cybersecurity Framework Functions.

6

NIST Privacy Framework

January 16, 2020

leveraged to further support the
management of risks associated withcybersecurity-related privacy eventsby using the Detect, Respond, andPrivacy
Cybersecurity
Recover Functions. Alternatively,
CybersecurityRisks
Risks
related privacy
organizations may use all five of theeventsIDENTIFY
Cybersecurity Framework Functions in
IDENTIFY-P
PROTECT-P
conjunction with Identify-P, Govern-P,
PROTECT
GOVERN-P
DETECT
Control-P, and Communicate-P to
DETECT
CONTROL-P
RESPOND
collectively address privacy and
RESPONDCOMMUNICATE-P
RECOVERcybersecurity risks. Figure 5 uses the
RECOVER
Venn diagram from section 1.2.1 todemonstrate how the Functions fromboth frameworks can be used in
Figure 5: Using Functions to Manage Cybersecurity andvarying combinations to manage
Privacy Risks
different aspects of privacy andcybersecurity risks. The five Privacy Framework Functions are defined as follows:•

Identify-P – Develop the organizational understanding to manage privacy risk for individuals
arising from data processing.
The activities in the Identify-P Function are foundational for effective use of the Privacy
Framework. Inventorying the circumstances under which data are processed, understanding theprivacy interests of individuals directly or indirectly served or affected by an organization, andconducting risk assessments enable an organization to understand the business environment inwhich it is operating and identify and prioritize privacy risks.

•

Govern-P – Develop and implement the organizational governance structure to enable an
ongoing understanding of the organization’s risk management priorities that are informed byprivacy risk.
The Govern-P Function is similarly foundational, but focuses on organizational-level activities
such as establishing organizational privacy values and policies, identifying legal/regulatory
requirements, and understanding organizational risk tolerance that enable an organization to
focus and prioritize its efforts, consistent with its risk management strategy and business needs.

•

Control-P – Develop and implement appropriate activities to enable organizations or individuals
to manage data with sufficient granularity to manage privacy risks.
The Control-P Function considers data processing management from the standpoint of bothorganizations and individuals.

•

Communicate-P – Develop and implement appropriate activities to enable organizations andindividuals to have a reliable understanding and engage in a dialogue about how data areprocessed and associated privacy risks.
The Communicate-P Function recognizes that both organizations and individuals may need toknow how data are processed in order to manage privacy risk effectively.

•

Protect-P – Develop and implement appropriate data processing safeguards.
The Protect-P Function covers data protection to prevent cybersecurity-related privacy events,
the overlap between privacy and cybersecurity risk management.
7

NIST Privacy Framework

January 16, 2020

ProfilesProfiles are a selection of specific Functions, Categories, and Subcategories from the Core that anorganization has prioritized to help it manage privacy risk. Profiles can be used to describe the current
state and the desired target state of specific privacy activities. A Current Profile indicates privacy
outcomes that an organization is currently achieving, while a Target Profile indicates the outcomes
needed to achieve the desired privacy risk management goals. The differences between the two Profiles
enable an organization to identify gaps, develop an action plan for improvement, and gauge theresources that would be needed (e.g., staffing, funding) to achieve privacy outcomes. This forms thebasis of an organization’s plan for reducing privacy risk in a cost-effective, prioritized manner. Profiles
also can aid in communicating risk within and between organizations by helping organizations
understand and compare the current and desired state of privacy outcomes.

TARGET

CURRENTPROFILES
The Privacy Framework does notprescribe Profile templates to allow
Identify-P
CORE
for flexibility in implementation.
Govern-P
Under the Privacy Framework’s riskIdentify-P
Protect-P
based approach, organizations may
not need to achieve every outcome
Govern-P
or activity reflected in the Core.
Identify-P
Control-P
When developing a Profile, anGovern-P
organization may select or tailor theCommunicate-P
Control-P
Functions, Categories, andProtect-P
Subcategories to its specific needs,
Communicate-P
including developing its own
Protect-P
additional Functions, Categories,
and Subcategories to account for
Figure 6: Relationship Between Core and Profiles
unique organizational risks. An
organization determines these needs by considering its mission or business objectives, privacy values,
and risk tolerance; role(s) in the data processing ecosystem or industry sector; legal/regulatory
requirements and industry best practices; risk management priorities and resources; and the privacy
needs of individuals who are directly or indirectly served or affected by an organization’s systems,
products, or services.
As illustrated in Figure 6, there is no specified order of development of Profiles. An organization may
first develop a Target Profile in order to focus on its desired outcomes for privacy and then develop a
Current Profile to identify gaps; alternatively, an organization may begin by identifying its current
activities, and then consider how to adjust these activities for its Target Profile. An organization may
choose to develop multiple Profiles for different roles, systems, products, or services, or categories ofindividuals (e.g., employees, customers) to enable better prioritization of activities and outcomes where
there may be differing degrees of privacy risk. Organizations in a certain industry sector or with similarroles in the data processing ecosystem may coordinate to develop common Profiles.

Implementation Tiers
Tiers support organizational decision-making about how to manage privacy risk by taking into accountthe nature of the privacy risks engendered by an organization’s systems, products, or services and thesufficiency of the processes and resources an organization has in place to manage such risks. Whenselecting Tiers, an organization should consider its Target Profile(s) and how achievement may besupported or hampered by its current risk management practices, the degree of integration of privacy
8

NIST Privacy Framework

January 16, 2020

risk into its enterprise risk management portfolio, its data processing ecosystem relationships, and its
workforce composition and training program.
There are four distinct Tiers, Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive(Tier 4), descriptions of which are in Appendix E. The Tiers represent a progression, albeit not a
compulsory one. Although organizations at Tier 1 will likely benefit from moving to Tier 2, not allorganizations need to achieve Tiers 3 or 4 (or may only focus on certain areas of these Tiers).
Progression to higher Tiers is appropriate when an organization’s processes or resources at its current
Tier may be insufficient to help it manage its privacy risks.
An organization can use the Tiers to communicate internally about resource allocations necessary toprogress to a higher Tier or as general benchmarks to gauge progress in its capability to manage privacy
risks. An organization can also use Tiers to understand the scale of resources and processes of otherorganizations in the data processing ecosystem and how they align with the organization’s privacy risk
management priorities. Nonetheless, successful implementation of the Privacy Framework is based
upon achieving the outcomes described in an organization’s Target Profile(s) and not upon Tier
determination.

3.0 How to Use the Privacy Framework
When used as a risk management tool, the Privacy Framework can assist an organization in its efforts tooptimize beneficial uses of data and the development of innovative systems, products, and services
while minimizing adverse consequences for individuals. The Privacy Framework can help organizations
answer the fundamental question, “How are we considering the impacts to individuals as we develop
our systems, products, and services?” To account for the unique needs of an organization, use of thePrivacy Framework is flexible, although it is designed to complement existing business and systemdevelopment operations. The decision about how to apply it is left to the implementing organization.
For example, an organization may already have robust privacy risk management processes, but may use
the Core’s five Functions as a streamlined way to analyze and articulate any gaps. Alternatively, anorganization seeking to establish a privacy program can use the Core’s Categories and Subcategories as areference. Other organizations may compare Profiles or Tiers to align privacy risk management priorities
across different roles in the data processing ecosystem. The variety of ways in which the Privacy
Framework can be used by organizations should discourage the notion of “compliance with the Privacy
Framework” as a uniform or externally referenceable concept. The following subsections present a few
options for use of the Privacy Framework.

Mapping to Informative References
Informative references are mappings to Subcategories to provide implementation support, including
mappings of tools, technical guidance, standards, laws, regulations, and best practices. Crosswalks that
map the provisions of standards, laws, and regulations to Subcategories can help organizations
determine which activities or outcomes to prioritize to facilitate compliance. The Privacy Framework is
technology neutral, but it supports technological innovation because any organization or industry sector
can develop these mappings as technology and related business needs evolve. By relying on consensusbased standards, guidelines, and practices, the tools and methods available to achieve positive privacy
outcomes can scale across borders and accommodate the global nature of privacy risks. The use ofexisting and emerging standards will enable economies of scale and drive the development of systems,
products, and services that meet identified market needs while being mindful of the privacy needs ofindividuals.
9

NIST Privacy Framework

January 16, 2020

Gaps in mappings can also be used to identify where additional or revised standards, guidelines, andpractices would help an organization to address emerging needs. An organization implementing a given
Subcategory, or developing a new Subcategory, might discover that there is insufficient guidance for a
related activity or outcome. To address that need, an organization might collaborate with technology
leaders and/or standards bodies to draft, develop, and coordinate standards, guidelines, or practices.
A repository of informative references can be found at https://www.nist.gov/privacy-framework. These
resources can support organizations’ use of the Privacy Framework and achievement of better privacy
practices.

Strengthening Accountability
Accountability is generally considered a key privacy principle, although conceptually it is not unique toprivacy. 13 Accountability occurs throughout an organization, and it can be expressed at varying degreesof abstraction, for example as a
C O L L A B O R A T I O N
cultural value, as governance policies
and procedures, or as traceability
Tier selection and Profile development
relationships between privacy
requirements and controls. Privacy
risk management can be a means ofsupporting accountability at all
Senior
Implementation/
Business/Processorganizational levels as it connects
Executive Level
Operations Level
ManagerLevelsenior executives, who can
Responsibilities:
Responsibilities:
Responsibilities:
communicate an organization’s•
Express
mission•Develop• Implement
privacy values and risk tolerance, topriorities, risk
ProfilesProfilesthose at the business/process
tolerance,• Allocate budget• Monitor
organizational
manager level, who can collaborate
privacy values,• Inform Tier
progresson the development andand budget
selection• Conduct privacy• Accept/decline
implementation of governancerisk assessments
risk decisions
policies and procedures that support
organizational privacy values. These
policies and procedures can then be
Privacy posture, changes in risk, implementation
progress, and incident management activities
communicated to those at theimplementation/operations level,C O M M U N I C A T I O N
who collaborate on defining the
Figure 7: Notional Collaboration and Communication Flows
privacy requirements that support
Within an Organization
the expression of the policies andprocedures in an organization’s systems, products, and services. Personnel at the13

See, e.g., Organisation for Economic Co-operation and Development (OECD) (2013) OECD Guidelines on theProtection of Privacy and Transborder Flows of Personal Data, available athttps://www.oecd.org/internet/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofper
sonaldata.htm; International Organization for Standardization (ISO)/International Electrotechnical Commission(IEC) (2011) ISO/IEC 29100:2011 – Information technology – Security techniques – Privacy framework (ISO,Geneva, Switzerland), available athttps://standards.iso.org/ittf/PubliclyAvailableStandards/c045123_ISO_IEC_29100_2011.zip; and Alliance ofAutomobile Manufacturers, Inc., Association of Global Automakers, Inc. (2014) Consumer Privacy Protection
Principles: Privacy Principles for Vehicle Technologies and Services, available at https://autoalliance.org/wpcontent/uploads/2017/01/Consumer_Privacy_Principlesfor_VehicleTechnologies_Services-03-21-19.pdf.

10

NIST Privacy Framework

January 16, 2020

implementation/operations level also select, implement, and assess controls as the technical and policy
measures that meet the privacy requirements, and report on progress, gaps and deficiencies, incident
management, and changing privacy risks so that those at the business/process manager level and thesenior executives can better understand and respond appropriately.
Figure 7 provides a graphical representation of this bi-directional collaboration and communication andhow elements of the Privacy Framework can be incorporated to facilitate the process. In this way,organizations can use the Privacy Framework as a tool to support accountability. They can also use thePrivacy Framework in conjunction with other frameworks and guidance that provide additional practices
to achieve accountability within and between organizations. 14

Establishing or Improving a Privacy Program
Using a simple model of “ready, set, go” phases, the Privacy Framework can support the creation of anew privacy program or improvement of an existing program. As an organization goes through thesephases, it may use informative references to provide guidance on prioritizing or achieving outcomes. See
section 3.1 for more information about informative references. In addition, a repository can be found athttps://www.nist.gov/privacy-framework.

Ready
Effective privacy risk management requires an organization tounderstand its mission or business environment; its legal
environment; its risk tolerance; the privacy risks engendered by its
systems, products, or services; and its role(s) in the data processing
ecosystem. An organization can use the Identify-P and Govern-P
Functions to “get ready” by reviewing the Categories andSubcategories, and beginning to develop its Current Profile andTarget Profile. 15 Activities and outcomes such as establishingorganizational privacy values and policies, determining andexpressing an organizational risk tolerance, and conducting privacy
risk assessments (see Appendix D for more information on privacy
risk assessments) provide a foundation for completing the Profiles
in “Set.”A Simplified Method for
Establishing or Improving
a Privacy Program
Ready: use the Identify-P
and Govern-P Functions
to get “ready.”
Set: “set” an action plan
based on the differences
between Current andTarget Profile(s).
Go: “go” forward with
implementing the action
plan.

Set
An organization completes its Current Profile by indicating which Category and Subcategory outcomesfrom the remaining Functions are being achieved. If an outcome is partially achieved, noting this fact will
help support subsequent steps by providing baseline information. Informed by the activities underIdentify and Govern, such as organizational privacy values and policies, organizational risk tolerance, andprivacy risk assessment results, an organization completes its Target Profile focused on the assessmentof the Categories and Subcategories describing its desired privacy outcomes. An organization also may
develop its own additional Functions, Categories, and Subcategories to account for uniqueorganizational risks. It may also consider influences and requirements of external stakeholders such as
14

15

See, e.g., NIST SP 800-37, Rev. 2, Risk Management Framework for Information Systems and Organizations: A
System Life Cycle Approach for Security and Privacy [7]; and Organization for the Advancement of Structured
Information Standards (OASIS) (2016) Privacy Management Reference Model and Methodology (PMRM)
Version 1.0, https://docs.oasis-open.org/pmrm/PMRM/v1.0/PMRM-v1.0.pdf.
For additional information, see the “Prepare” step, Section 3.1, NIST SP 800-37, Rev. 2 [7].

11

NIST Privacy Framework

January 16, 2020

business customers and partners when creating a Target Profile. An organization can develop multiple
Profiles to support its different business lines or processes, which may have different business needs
and associated risk tolerances.
An organization compares the Current Profile and the Target Profile to determine gaps. Next, it creates aprioritized action plan to address gaps—reflecting mission drivers, costs and benefits, and risks—toachieve the outcomes in the Target Profile. An organization using the Cybersecurity Framework and thePrivacy Framework together may develop integrated action plans. It then determines resources,
including funding and workforce needs, necessary to address the gaps, which can inform the selection ofan appropriate Tier. Using Profiles in this manner encourages an organization to make informed
decisions about privacy activities, supports risk management, and enables an organization to perform
cost-effective, targeted improvements.

GoWith the action plan “set,” an organization prioritizes which actions to take to address any gaps, andthen adjusts its current privacy practices in order to achieve the Target Profile. 16
An organization can go through the phases nonsequentially as needed to continuously assess andimprove its privacy posture. For instance, an organization may find that more frequent repetition of the
Ready phase improves the quality of privacy risk assessments. Furthermore, an organization may
monitor progress through iterative updates to the Current Profile or the Target Profile to adjust tochanging risks, subsequently comparing the Current Profile to the Target Profile.

Applying to the System Development Life Cycle
The Target Profile can be aligned with the system development life cycle (SDLC) phases of plan, design,build/buy, deploy, operate, and decommission to support the achievement of the prioritized privacy
outcomes. 17 Beginning with the plan phase the prioritized privacy outcomes can be transformed into theprivacy capabilities and requirements for the system, recognizing that requirements are likely to evolve
during the remainder of the life cycle. A key milestone of the design phase is validating that the privacy
capabilities and requirements match the needs and risk tolerance of an organization as expressed in theTarget Profile. That same Target Profile can serve as an internal list to be assessed when deploying thesystem to verify that all privacy capabilities and requirements are implemented. The privacy outcomes
determined by using the Privacy Framework should then serve as a basis for ongoing operation of thesystem. This includes occasional reassessment, capturing results in a Current Profile, to verify thatprivacy capabilities and requirements are still fulfilled.
Privacy risk assessments typically focus on the data life cycle, the stages through which data passes,
often characterized as creation or collection, processing, dissemination, use, storage, and disposition, to
include destruction and deletion. Aligning the SDLC and the data lifecycle by identifying andunderstanding how data are processed during all stages of the SDLC helps organizations to better
manage privacy risks and informs the selection and implementation of privacy controls to meet privacy
requirements.

16
17

NIST SP 800-37, Rev. 2 [7] provides additional information on steps to execute on the action plan, including
control selection, implementation, and assessment to close any gaps.
Within the SDLC, organizations may employ a variety of development methodologies (e.g., waterfall, spiral, or
agile).

12

NIST Privacy Framework

January 16, 2020

Using within the Data Processing Ecosystem
A key factor in the management ofprivacy risk is an entity’s role(s) in thedata processing ecosystem, which can
Public/affect not only its legal obligations, but
Government
Servicesalso the measures it may take to manage
Individuals
privacy risk. As depicted in Figure 8, theManufacturer
data processing ecosystem encompasses
a range of entities and roles that may
have complex, multi-directional
Supplier or
Civil
relationships with each other andService
Society
Providerindividuals. Complexity can increase
when entities are supported by a chainof sub-entities; for example, service
providers may be supported by a series
Business
Research/
Associatesof service providers, or manufacturers
Education
or Partners
may have multiple component suppliers.
Figure 8 displays entities as having
Commercial
Product/
distinct roles, but some may have
Services
Developer
multiple roles, such as an organization
providing services to other organizations
Figure 8: Data Processing Ecosystem Relationships
and providing retail products to
consumers. The roles in Figure 8 are intended to be notional classifications. In practice, an entity’srole(s) may be legally codified—for example, some laws classify organizations as data controllers or dataprocessors—or classifications may be derived from industry sector designations.
By developing one or more Profiles relevant to its role(s), an entity can use the Privacy Framework to
consider how to manage privacy risk not only with regard to its own priorities, but also in relation to
how the measures it may take affect other data processing ecosystem entities’ management of privacy
risk. For example:•

An organization that makes decisions about how to collect and use data about individuals may
use a Profile to express privacy requirements to an external service provider (e.g., a cloudprovider to which it is exporting data); the external service provider that processes the data may
use its Profile to demonstrate the measures it has adopted to process data in line with
contractual obligations.

•

An organization may express its privacy posture through a Current Profile to report results or tocompare with acquisition requirements.

•

An industry sector may establish a common Profile that can be used by its members tocustomize their own Profiles.
A manufacturer may use a Target Profile to determine the capabilities to build into its products
so that its business customers can meet the privacy needs of their end users.

••

A developer may use a Target Profile to consider how to design an application that enables
privacy protections when used within other organizations’ system environments.

The Privacy Framework provides a common language to communicate privacy requirements withentities within the data processing ecosystem. The need for this communication can be particularly
13

NIST Privacy Framework

January 16, 2020

notable when the data processing ecosystem crosses national boundaries, such as with international
data transfers. Organizational practices that support communication may include:•

Determining privacy requirements;•

Enacting privacy requirements through formal agreement (e.g., contracts, multi-party
frameworks);•

Communicating how those privacy requirements will be verified and validated;•

Verifying that privacy requirements are met through a variety of assessment methodologies;
and•Governing and managing the above activities.

Informing Buying Decisions
Since either a Current or Target Profile can be used to generate a prioritized list of privacy requirements,
these Profiles can also be used to inform decisions about buying products and services. By first selecting
outcomes that are relevant to its privacy goals, an organization then can evaluate partners’ systems,
products, or services against this outcome. For example, if a device is being purchased forenvironmental monitoring of a forest, manageability may be important to support capabilities forminimizing the processing of data about people using the forest and should drive a manufacturer
evaluation against applicable Subcategories in the Core (e.g., CT.DP-P4: system or device configurations
permit selective collection or disclosure of data elements).
In circumstances where it may not be possible to impose a set of privacy requirements on the supplier,the objective should be to make the best buying decision among multiple suppliers, given a carefully
determined list of privacy requirements. Often, this means some degree of trade-off, comparing
multiple products or services with known gaps to the Profile. If the system, product, or service
purchased did not meet all of the objectives described in the Profile, an organization could address theresidual risk through mitigation measures or other management actions.

14

NIST Privacy Framework

January 16, 2020

References[1]

National Institute of Standards and Technology (2018) Framework for Improving Critical
Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards and Technology,
Gaithersburg, MD). https://doi.org/10.6028/NIST.CSWP.04162018[2]
National Institute of Standards and Technology (2019) Summary Analysis of the Responses to the
NIST Privacy Framework Request for Information. (National Institute of Standards andTechnology, Gaithersburg, MD).
https://www.nist.gov/sites/default/files/documents/2019/02/27/
rfi_response_analysis_privacyframework_2.27.19.pdf[3]
National Institute of Standards and Technology (2019) NIST Privacy Risk Assessment
Methodology (PRAM). (National Institute of Standards and Technology, Gaithersburg, MD).
https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/resources[4]
The Smart Grid Interoperability Panel—Smart Grid Cybersecurity Committee (2014) Guidelines
for Smart Grid Cybersecurity: Volume 1 - Smart Grid Cybersecurity Strategy, Architecture, andHigh-Level Requirements. (National Institute of Standards and Technology, Gaithersburg, MD),NIST Interagency or Internal Report (IR) 7628, Rev. 1, Vol. 1.
https://doi.org/10.6028/NIST.IR.7628r1[5]
Brooks SW, Garcia ME, Lefkovitz NB, Lightman S, Nadeau EM (2017) An Introduction to Privacy
Engineering and Risk Management in Federal Systems. (National Institute of Standards andTechnology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8062.
https://doi.org/10.6028/NIST.IR.8062[6]
Joint Task Force Transformation Initiative (2011) Managing Information Security Risk:
Organization, Mission, and Information System View. (National Institute of Standards andTechnology, Gaithersburg, MD). NIST Special Publication (SP) 800-39.
https://doi.org/10.6028/NIST.SP.800-39[7]
Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations:
A System Life Cycle Approach for Security and Privacy. (National Institute of Standards andTechnology, Gaithersburg, MD), NIST Special Publication (SP) 800-37 Rev. 2.
https://doi.org/10.6028/NIST.SP.800-37r2[8]
Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards
and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates asof December 1, 2017. https://doi.org/10.6028/NIST.SP.800-63-3[9]
Office of Management and Budget (2017) Preparing for and Responding to a Breach of PersonallyIdentifiable Information. (The White House, Washington, DC), OMB Memorandum M-17-12,
January 3, 2017. Available athttps://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-1712_0.pdf[10] Joint Task Force Transformation Initiative (2013) Security and Privacy Controls for Federal
Information Systems and Organizations. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 4, Includes updates as of January
22, 2015. https://doi.org/10.6028/NIST.SP.800-53r4[11] Grassi PA, Lefkovitz NB, Nadeau EM, Galluzzo RJ, Dinh AT (2018) Attribute Metadata: A Proposed
Schema for Evaluating Federated Attributes. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8112.
https://doi.org/10.6028/NIST.IR.8112

15

NIST Privacy Framework

January 16, 2020[12] Joint Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP)
800-30, Rev. 1. https://doi.org/10.6028/NIST.SP.800-30r1[13] “Definitions,” Title 44 U.S. Code, Sec. 3542. 2011 ed.
https://www.govinfo.gov/app/details/USCODE-2011-title44/USCODE-2011-title44-chap35subchapIII-sec3542

16

NIST Privacy Framework

January 16, 2020

Appendix A: Privacy Framework Core
This appendix presents the Core: a table of Functions, Categories, and Subcategories that describe
specific activities and outcomes that can support managing privacy risks when systems, products, andservices are processing data.

Note to Users

Risk-based Approach:•

The Core is not a checklist of actions to perform. An organization selects Subcategories
consistent with its risk strategy to protect individuals’ privacy, as noted in Category
statements. An organization may not need to achieve every outcome or activity reflected in theCore. It is expected that an organization will use Profiles to select and prioritize the Functions,Categories, and Subcategories that best meet its specific needs by considering its goals, role(s) inthe data processing ecosystem or industry sector, legal/regulatory requirements and industry
best practices, risk management priorities, and the privacy needs of individuals who are directly
or indirectly served or affected by an organization’s systems, products, or services.

•

It is not obligatory to achieve an outcome in its entirety. An organization may use its Profiles toexpress partial achievement of an outcome, as not all aspects of an outcome may be relevant
for it to manage privacy risk, or an organization may use a Target Profile to express an aspect ofan outcome that it does not currently have the capability to achieve.

•

It may be necessary to consider multiple outcomes in combination to appropriately manage
privacy risk. For example, an organization that responds to individuals’ requests for data accessmay select for its Profile both the Subcategory CT.DM-P1: “Data elements can be accessed forreview” and the Category “Identity Management, Authentication, and Access Control” (PR.AC-P)
to ensure that only the individual to whom the data pertain gets access.

Implementation: The tabular format of the Core is not intended to suggest a specific implementation
order or imply a degree of importance between the Functions, Categories, and Subcategories.
Implementation may be nonsequential, simultaneous, or iterative, depending on the SDLC stage, statusof the privacy program, scale of the workforce, or role(s) of an organization in the data processing
ecosystem. In addition, the Core is not exhaustive; it is extensible, allowing organizations, sectors, andother entities to adapt or add additional Functions, Categories, and Subcategories to their Profiles.
Roles:•

Ecosystem Roles: The Core is intended to be usable by any organization or entity regardless of
its role(s) in the data processing ecosystem. Although the Privacy Framework does not classify
ecosystem roles, an organization should review the Core from its standpoint in the ecosystem.
An organization’s role(s) may be legally codified—for example, some laws classify organizations
as data controllers or data processors—or classifications may be derived from industry
designations. Since Core elements are not assigned by ecosystem role, an organization can use
its Profiles to select Functions, Categories, and Subcategories that are relevant to its role(s).

•Organizational Roles: Different parts of an organization’s workforce may take responsibility for
different Categories or Subcategories. For example, the legal department may be responsible forcarrying out activities under “Governance Policies, Processes, and Procedures” while the IT
department is working on “Inventory and Mapping.” Ideally, the Core encourages crossorganization collaboration to develop Profiles and achieve outcomes.
17

NIST Privacy Framework

January 16, 2020

Scalability: Certain aspects of outcomes may be ambiguously worded. For example, outcomes may
include terms like “communicated” or “disclosed” without stating to whom the communications ordisclosures are being made. The ambiguity is intentional to allow for a wide range of organizations withdifferent use cases to determine what is appropriate or required in a given context.
Resource Repository: Standalone resources that can provide more information on how to prioritize or
achieve outcomes can be found at https://www.nist.gov/privacy-framework.
Cybersecurity Framework Alignment:•

As noted in section 2.1, organizations can use the five Privacy Framework Functions—Identify-P,
Govern-P, Control-P, Communicate-P, and Protect-P—to manage privacy risks arising from dataprocessing. Protect-P is specifically focused on managing risks associated with security-related
privacy events (e.g., privacy breaches). To further support the management of risks associatedwith security-related privacy events, organizations may choose to use Detect, Respond, andRecover Functions from the Cybersecurity Framework. For this reason, these Functions areincluded in Table 1, but are greyed out. Alternatively, organizations may use all five of the
Cybersecurity Framework Functions in conjunction with Identify-P, Govern-P, Control-P, andCommunicate-P to collectively address privacy and security risks. See Figure 5 for an illustrated
example of how the Functions from both frameworks can be used in varying combinations tomanage different aspects of privacy and cybersecurity risks.

•

Certain Functions, Categories, or Subcategories may be identical to or have been adapted fromthe Cybersecurity Framework. The following legend can be used to identify this relationship in
Table 2. A complete crosswalk between the two frameworks can be found in the resource
repository at https://www.nist.gov/privacy-framework.
The Function, Category, or Subcategory aligns with the Cybersecurity
Framework, but the text has been adapted for the Privacy Framework.
The Category or Subcategory is identical to the Cybersecurity Framework.

Core Identifiers: For ease of use, each component of the Core is given a unique identifier. Functions andCategories each have a unique alphabetic identifier, as shown in Table 1. Subcategories within eachCategory have a number added to the alphabetic identifier; the unique identifier for each Subcategory is
included in Table 2.

18

NIST Privacy Framework

January 16, 2020

Table 1: Privacy Framework Function and Category Unique Identifiers
Function
UniqueIdentifier
ID-P

GV-P

CT-P

CM-P
PR-P

DE

RS

RC

Function
Identify-P

Govern-P

Control-P

Communicate-P
Protect-P

DetectRespond

Recover

Category
UniqueIdentifier
ID.IM-P

Category

ID.BE-PBusiness Environment

ID.RA-P

Risk Assessment

ID.DE-P

Data Processing Ecosystem Risk Management

GV.PO-P

Governance Policies, Processes, and Procedures

GV.RM-P

Risk Management Strategy

GV.AT-P

Awareness and Training

GV.MT-P

Monitoring and Review

CT.PO-P

Data Processing Policies, Processes, and Procedures

CT.DM-P

Data Processing Management

CT.DP-P

Disassociated Processing

CM.PO-P

Communication Policies, Processes, and Procedures

CM.AW-P

Data Processing AwarenessPR.PO-P

Data Protection Policies, Processes, and Procedures

PR.AC-P

Identity Management, Authentication, and AccessControl

PR.DS-P

Data Security

PR.MA-P

Maintenance

PR.PT-PProtective Technology

DE.AE

Anomalies and Events

DE.CM

Security Continuous Monitoring

DE.DP

Detection Processes

RS.RP

Response Planning

RS.CO

Communications

RS.AN

Analysis

RS.MI

Mitigation

RS.IM

Improvements

RC.RP

Recovery Planning

RC.IM

Improvements

RC.CO

Communications

Inventory and Mapping

19

NIST Privacy Framework

January 16, 2020
Table 2: Privacy Framework Core

Function
IDENTIFY-P (IDP): Develop theorganizational
understanding
to manage
privacy risk forindividuals
arising fromdata
processing.

Category
Inventory and Mapping (ID.IM-P): Data
processing by systems, products, or services
is understood and informs the managementof privacy risk.

Business Environment (ID.BE-P): The
organization’s mission, objectives,
stakeholders, and activities areunderstood and prioritized; thisinformation is used to inform privacy
roles, responsibilities, and risk
management decisions.

Subcategory
ID.IM-P1: Systems/products/services that process data areinventoried.
ID.IM-P2: Owners or operators (e.g., the organization or third parties
such as service providers, partners, customers, and developers) andtheir roles with respect to the systems/products/services andcomponents (e.g., internal or external) that process data areinventoried.
ID.IM-P3: Categories of individuals (e.g., customers, employees orprospective employees, consumers) whose data are being processed
are inventoried.
ID.IM-P4: Data actions of the systems/products/services areinventoried.
ID.IM-P5: The purposes for the data actions are inventoried.
ID.IM-P6: Data elements within the data actions are inventoried.
ID.IM-P7: The data processing environment is identified (e.g.,geographic location, internal, cloud, third parties).
ID.IM-P8: Data processing is mapped, illustrating the data actions andassociated data elements for systems/products/services, including
components; roles of the component owners/operators; andinteractions of individuals or third parties with thesystems/products/services.
ID.BE-P1: The organization’s role(s) in the data processing
ecosystem are identified and communicated.
ID.BE-P2: Priorities for organizational mission, objectives, andactivities are established and communicated.
ID.BE-P3: Systems/products/services that support organizational
priorities are identified and key requirements communicated.

20

NIST Privacy Framework
FunctionJanuary 16, 2020
Category
Risk Assessment (ID.RA-P): The
organization understands the privacy risks
to individuals and how such privacy risks
may create follow-on impacts onorganizational operations, including
mission, functions, other risk management
priorities (e.g., compliance, financial),
reputation, workforce, and culture.

Data Processing Ecosystem Risk
Management (ID.DE-P): The
organization’s priorities, constraints, risk
tolerance, and assumptions are
established and used to support risk
decisions associated with managing
privacy risk and third parties within thedata processing ecosystem. The
organization has established andimplemented the processes to identify,
assess, and manage privacy risks within
the data processing ecosystem.

Subcategory
ID.RA-P1: Contextual factors related to the systems/products/services
and the data actions are identified (e.g., individuals’ demographics andprivacy interests or perceptions, data sensitivity and/or types, visibilityof data processing to individuals and third parties).
ID.RA-P2: Data analytic inputs and outputs are identified andevaluated for bias.
ID.RA-P3: Potential problematic data actions and associated problems
are identified.
ID.RA-P4: Problematic data actions, likelihoods, and impacts areused to determine and prioritize risk.
ID.RA-P5: Risk responses are identified, prioritized, andimplemented.
ID.DE-P1: Data processing ecosystem risk management policies,
processes, and procedures are identified, established, assessed,
managed, and agreed to by organizational stakeholders.
ID.DE-P2: Data processing ecosystem parties (e.g., service
providers, customers, partners, product manufacturers, application
developers) are identified, prioritized, and assessed using a privacy
risk assessment process.
ID.DE-P3: Contracts with data processing ecosystem parties areused to implement appropriate measures designed to meet theobjectives of an organization’s privacy program.
ID.DE-P4: Interoperability frameworks or similar multi-party
approaches are used to manage data processing ecosystem privacy
risks.
ID.DE-P5: Data processing ecosystem parties are routinely assessedusing audits, test results, or other forms of evaluations to confirm
they are meeting their contractual, interoperability framework, orother obligations.

21

NIST Privacy Framework
Function
GOVERN-P (GV-P):
Develop andimplement theorganizational
governancestructure toenable an ongoingunderstanding of
the organization’srisk management
priorities thatare informed byprivacy risk.

January 16, 2020
Category
Governance Policies, Processes, andProcedures (GV.PO-P): The policies,
processes, and procedures to manage andmonitor the organization’s regulatory,
legal, risk, environmental, and operational
requirements are understood and informthe management of privacy risk.

Risk Management Strategy (GV.RM-P):
The organization’s priorities, constraints,risk tolerances, and assumptions are
established and used to support
operational risk decisions.
Awareness and Training (GV.AT-P): The
organization’s workforce and third parties
engaged in data processing are provided
privacy awareness education and aretrained to perform their privacy-related
duties and responsibilities consistent withrelated policies, processes, procedures,
and agreements and organizational
privacy values.

Subcategory
GV.PO-P1: Organizational privacy values and policies (e.g.,conditions on data processing such as data uses or retention
periods, individuals’ prerogatives with respect to data processing)are established and communicated.
GV.PO-P2: Processes to instill organizational privacy values within
system/product/service development and operations are establishedand in place.
GV.PO-P3: Roles and responsibilities for the workforce areestablished with respect to privacy.
GV.PO-P4: Privacy roles and responsibilities are coordinated andaligned with third-party stakeholders (e.g., service providers,customers, partners).
GV.PO-P5: Legal, regulatory, and contractual requirements
regarding privacy are understood and managed.
GV.PO-P6: Governance and risk management policies, processes,
and procedures address privacy risks.
GV.RM-P1: Risk management processes are established, managed,
and agreed to by organizational stakeholders.
GV.RM-P2: Organizational risk tolerance is determined and clearly
expressed.
GV.RM-P3: The organization’s determination of risk tolerance isinformed by its role(s) in the data processing ecosystem.
GV.AT-P1: The workforce is informed and trained on its roles andresponsibilities.
GV.AT-P2: Senior executives understand their roles andresponsibilities.
GV.AT-P3: Privacy personnel understand their roles andresponsibilities.
GV.AT-P4: Third parties (e.g., service providers, customers,
partners) understand their roles and responsibilities.

22

NIST Privacy Framework

January 16, 2020

Function

Category
Monitoring and Review (GV.MT-P): The
policies, processes, and procedures forongoing review of the organization’s privacy
posture are understood and inform the
management of privacy risk.

CONTROL-P (CTP): Develop andimplement
appropriate
activities to enableorganizations or
individuals tomanage data with
sufficientgranularity toData Processing Policies, Processes, andProcedures (CT.PO-P): Policies, processes,
and procedures are maintained and used to
manage data processing (e.g., purpose,scope, roles and responsibilities in the dataprocessing ecosystem, and management
commitment) consistent with theorganization’s risk strategy to protect
individuals’ privacy.

Subcategory
GV.MT-P1: Privacy risk is re-evaluated on an ongoing basis and as key
factors, including the organization’s business environment (e.g.,
introduction of new technologies), governance (e.g., legal obligations,risk tolerance), data processing, and systems/products/services
change.
GV.MT-P2: Privacy values, policies, and training are reviewed and any
updates are communicated.
GV.MT-P3: Policies, processes, and procedures for assessing
compliance with legal requirements and privacy policies are
established and in place.
GV.MT-P4: Policies, processes, and procedures for communicating
progress on managing privacy risks are established and in place.
GV.MT-P5: Policies, processes, and procedures are established and inplace to receive, analyze, and respond to problematic data actions
disclosed to the organization from internal and external sources (e.g.,internal discovery, privacy researchers, professional events).
GV.MT-P6: Policies, processes, and procedures incorporate lessons
learned from problematic data actions.
GV.MT-P7: Policies, processes, and procedures for receiving, tracking,and responding to complaints, concerns, and questions fromindividuals about organizational privacy practices are established andin place.
CT.PO-P1: Policies, processes, and procedures for authorizing dataprocessing (e.g., organizational decisions, individual consent), revoking
authorizations, and maintaining authorizations are established and inplace.
CT.PO-P2: Policies, processes, and procedures for enabling data
review, transfer, sharing or disclosure, alteration, and deletion are
established and in place (e.g., to maintain data quality, manage dataretention).
CT.PO-P3: Policies, processes, and procedures for enabling individuals’
data processing preferences and requests are established and in place.
23

NIST Privacy Framework
Functionmanage privacy
risks.

January 16, 2020
Category

Data Processing Management (CT.DM-P):
Data are managed consistent with theorganization’s risk strategy to protect
individuals’ privacy, increase manageability,and enable the implementation of privacy
principles (e.g., individual participation, data
quality, data minimization).

Disassociated Processing (CT.DP-P): Data
processing solutions increase disassociability
consistent with the organization’s risk
strategy to protect individuals’ privacy andenable implementation of privacy principles(e.g., data minimization).

Subcategory
CT.PO-P4: A data life cycle to manage data is aligned andimplemented with the system development life cycle to manage
systems.
CT.DM-P1: Data elements can be accessed for review.
CT.DM-P2: Data elements can be accessed for transmission or
disclosure.
CT.DM-P3: Data elements can be accessed for alteration.
CT.DM-P4: Data elements can be accessed for deletion.
CT.DM-P5: Data are destroyed according to policy.
CT.DM-P6: Data are transmitted using standardized formats.
CT.DM-P7: Mechanisms for transmitting processing permissions andrelated data values with data elements are established and in place.
CT.DM-P8: Audit/log records are determined, documented,
implemented, and reviewed in accordance with policy andincorporating the principle of data minimization.
CT.DM-P9: Technical measures implemented to manage dataprocessing are tested and assessed.
CT.DM-P10: Stakeholder privacy preferences are included inalgorithmic design objectives and outputs are evaluated against
these preferences.
CT.DP-P1: Data are processed to limit observability and linkability (e.g.,
data actions take place on local devices, privacy-preserving
cryptography).
CT.DP-P2: Data are processed to limit the identification of individuals(e.g., de-identification privacy techniques, tokenization).
CT.DP-P3: Data are processed to limit the formulation of inferences
about individuals’ behavior or activities (e.g., data processing isdecentralized, distributed architectures).
CT.DP-P4: System or device configurations permit selective collection
or disclosure of data elements.
CT.DP-P5: Attribute references are substituted for attribute values.
24

NIST Privacy Framework

January 16, 2020

Function
COMMUNICATE-P(CM-P): Develop
and implement
appropriate
activities to enableorganizations andindividuals to havea reliable
understanding andengage in a
dialogue about
how data areprocessed andassociated privacy
risks.

Category
Communication Policies, Processes, andProcedures (CM.PO-P): Policies, processes,
and procedures are maintained and used toincrease transparency of the organization’s
data processing practices (e.g., purpose,scope, roles and responsibilities in the dataprocessing ecosystem, and management
commitment) and associated privacy risks.
Data Processing Awareness (CM.AW-P):
Individuals and organizations have reliableknowledge about data processing practices
and associated privacy risks, and effective
mechanisms are used and maintained toincrease predictability consistent with theorganization’s risk strategy to protect
individuals’ privacy.

PROTECT-P(PR-P): Develop
and implement

Data Protection Policies, Processes, andProcedures (PR.PO-P): Security andprivacy policies (e.g., purpose, scope, roles

Subcategory
CM.PO-P1: Transparency policies, processes, and procedures forcommunicating data processing purposes, practices, and associatedprivacy risks are established and in place.
CM.PO-P2: Roles and responsibilities (e.g., public relations) for
communicating data processing purposes, practices, and associatedprivacy risks are established.
CM.AW-P1: Mechanisms (e.g., notices, internal or public reports) for
communicating data processing purposes, practices, associated privacy
risks, and options for enabling individuals’ data processing preferences
and requests are established and in place.
CM.AW-P2: Mechanisms for obtaining feedback from individuals (e.g.,surveys or focus groups) about data processing and associated privacy
risks are established and in place.
CM.AW-P3: System/product/service design enables data processing
visibility.
CM.AW-P4: Records of data disclosures and sharing are maintained
and can be accessed for review or transmission/disclosure.
CM.AW-P5: Data corrections or deletions can be communicated toindividuals or organizations (e.g., data sources) in the data processing
ecosystem.
CM.AW-P6: Data provenance and lineage are maintained and can beaccessed for review or transmission/disclosure.
CM.AW-P7: Impacted individuals and organizations are notified abouta privacy breach or event.
CM.AW-P8: Individuals are provided with mitigation mechanisms (e.g.,credit monitoring, consent withdrawal, data alteration or deletion) toaddress impacts of problematic data actions.
PR.PO-P1: A baseline configuration of information technology iscreated and maintained incorporating security principles (e.g.,concept of least functionality).
25

NIST Privacy Framework
Function
appropriate
data processing
safeguards.

January 16, 2020
Category
and responsibilities in the data processing
ecosystem, and management
commitment), processes, and procedures
are maintained and used to manage theprotection of data.

Identity Management, Authentication,
and Access Control (PR.AC-P): Access todata and devices is limited to authorizedindividuals, processes, and devices, and ismanaged consistent with the assessed riskof unauthorized access.

Data Security (PR.DS-P): Data aremanaged consistent with the

Subcategory
PR.PO-P2: Configuration change control processes are establishedand in place.
PR.PO-P3: Backups of information are conducted, maintained, andtested.
PR.PO-P4: Policy and regulations regarding the physical operating
environment for organizational assets are met.
PR.PO-P5: Protection processes are improved.
PR.PO-P6: Effectiveness of protection technologies is shared.
PR.PO-P7: Response plans (Incident Response and BusinessContinuity) and recovery plans (Incident Recovery and Disaster
Recovery) are established, in place, and managed.
PR.PO-P8: Response and recovery plans are tested.
PR.PO-P9: Privacy procedures are included in human resources
practices (e.g., deprovisioning, personnel screening).
PR.PO-P10: A vulnerability management plan is developed andimplemented.
PR.AC-P1: Identities and credentials are issued, managed, verified,
revoked, and audited for authorized individuals, processes, anddevices.
PR.AC-P2: Physical access to data and devices is managed.
PR.AC-P3: Remote access is managed.
PR.AC-P4: Access permissions and authorizations are managed,
incorporating the principles of least privilege and separation ofduties.
PR.AC-P5: Network integrity is protected (e.g., network
segregation, network segmentation).
PR.AC-P6: Individuals and devices are proofed and bound tocredentials, and authenticated commensurate with the risk of thetransaction (e.g., individuals’ security and privacy risks and otherorganizational risks).
PR.DS-P1: Data-at-rest are protected.
PR.DS-P2: Data-in-transit are protected.
26

NIST Privacy Framework
FunctionJanuary 16, 2020
Category
organization’s risk strategy to protect
individuals’ privacy and maintain data
confidentiality, integrity, and availability.

Maintenance (PR.MA-P): System
maintenance and repairs are performed
consistent with policies, processes, andprocedures.
Protective Technology (PR.PT-P):
Technical security solutions are managed
to ensure the security and resilience ofsystems/products/services and associateddata, consistent with related policies,
processes, procedures, and agreements.

Subcategory
PR.DS-P3: Systems/products/services and associated data areformally managed throughout removal, transfers, and disposition.
PR.DS-P4: Adequate capacity to ensure availability is maintained.
PR.DS-P5: Protections against data leaks are implemented.
PR.DS-P6: Integrity checking mechanisms are used to verify
software, firmware, and information integrity.
PR.DS-P7: The development and testing environment(s) are
separate from the production environment.
PR.DS-P8: Integrity checking mechanisms are used to verify
hardware integrity.
PR.MA-P1: Maintenance and repair of organizational assets are
performed and logged, with approved and controlled tools.
PR.MA-P2: Remote maintenance of organizational assets isapproved, logged, and performed in a manner that prevents
unauthorized access.
PR.PT-P1: Removable media is protected and its use restrictedaccording to policy.
PR.PT-P2: The principle of least functionality is incorporated byconfiguring systems to provide only essential capabilities.
PR.PT-P3: Communications and control networks are protected.
PR.PT-P4: Mechanisms (e.g., failsafe, load balancing, hot swap) are
implemented to achieve resilience requirements in normal andadverse situations.

27

NIST Privacy Framework

January 16, 2020

Appendix B: Glossary
This appendix defines selected terms used for the purposes of this publication.
Attribute Reference(NIST SP 800-63-3 [8])A statement asserting a property of a subscriber without necessarily
containing identity information, independent of format. For example, forthe attribute “birthday,” a reference could be “older than 18” or “born inDecember.”

Attribute Value(NIST SP 800-63-3 [8])A complete statement asserting a property of a subscriber, independentof format. For example, for the attribute “birthday,” a value could be“12/1/1980” or “December 1, 1980.”

Availability(44 U.S.C. [13])Ensuring timely and reliable access to and use of information.

Category

The subdivision of a Function into groups of privacy outcomes closely tied
to programmatic needs and particular activities.

Communicate-P(Function)

Develop and implement appropriate activities to enable organizations
and individuals to have a reliable understanding and engage in a dialogue
about how data are processed and associated privacy risks.

Confidentiality(44 U.S.C. [13])Preserving authorized restrictions on information access and disclosure,including means for protecting personal privacy and proprietary
information.

Control-P (Function)

Develop and implement appropriate activities to enable organizations or
individuals to manage data with sufficient granularity to manage privacy
risks.

Core

A set of privacy protection activities and outcomes. The Framework Core
comprises three elements: Functions, Categories, and Subcategories.

Cybersecurity Incident(Framework for
Improving Critical
Infrastructure
Cybersecurity [1])A cybersecurity event that has been determined to have an impact on theorganization prompting the need for response and recovery.

(OMB 17-12 [9])An occurrence that (1) actually or imminently jeopardizes, without lawfulauthority, the integrity, confidentiality, or availability of information or an
information system; or (2) constitutes a violation or imminent threat ofviolation of law, security policies, security procedures, or acceptable use
policies.

Data

A representation of information, including digital and non-digital formats.

28

NIST Privacy Framework

January 16, 2020

Data Action (Adaptedfrom NIST IR 8062 [5])A system/product/service data life cycle operation, including, but notlimited to collection, retention, logging, generation, transformation, use,
disclosure, sharing, transmission, and disposal.

Data Element

The smallest named item of data that conveys meaningful information.

Data Processing(Adapted from NIST IR
8062 [5])The collective set of data actions (i.e., the complete data life cycle,
including, but not limited to collection, retention, logging, generation,transformation, use, disclosure, sharing, transmission, and disposal).

Data Processing
Ecosystem

The complex and interconnected relationships among entities involved increating or deploying systems, products, or services or any componentsthat process data.

Disassociability (Adaptedfrom NIST IR 8062 [5])Enabling the processing of data or events without association toindividuals or devices beyond the operational requirements of thesystem.

Function

A component of the Core that provides the highest level of structure fororganizing basic privacy activities into Categories and Subcategories.

Govern-P (Function)

Develop and implement the organizational governance structure toenable an ongoing understanding of the organization’s risk management
priorities that are informed by privacy risk.

Identify-P (Function)

Develop the organizational understanding to manage privacy risk forindividuals arising from data processing.

Implementation Tier

Provides a point of reference on how an organization views privacy risk
and whether it has sufficient processes and resources in place to manage
that risk.

Individual

A single person or a group of persons, including at a societal level.

Integrity(44 U.S.C. [13])Guarding against improper information modification or destruction, andincludes ensuring information non-repudiation and authenticity.

Lineage

The history of processing of a data element, which may include point-topoint data flows and the data actions performed upon the data element.

Manageability (Adaptedfrom NIST IR 8062 [5])Providing the capability for granular administration of data, including
alteration, deletion, and selective disclosure.

Metadata (Adapted fromNIST SP 800-53 [10])Information describing the characteristics of data.

Predictability (Adaptedfrom NIST IR 8062 [5])Enabling reliable assumptions by individuals, owners, and operators
about data and their processing by a system, product, or service.

This may include, for example, structural metadata describing data
structures (i.e., data format, syntax, semantics) and descriptive metadata
describing data contents.

29

NIST Privacy Framework

January 16, 2020

Privacy Breach (Adaptedfrom OMB M-17-12 [9])The loss of control, compromise, unauthorized disclosure, unauthorizedacquisition, or any similar occurrence where (1) a person other than an
authorized user accesses or potentially accesses data or (2) an authorizeduser accesses data for an other than authorized purpose.

Privacy Control (Adaptedfrom NIST SP 800-37 [7])The administrative, technical, and physical safeguards employed within
an organization to satisfy privacy requirements.

Privacy Event

The occurrence or potential occurrence of problematic data actions.

Privacy Requirement

A specification for system/product/service functionality to meetstakeholders’ desired privacy outcomes.

Privacy Risk

The likelihood that individuals will experience problems resulting fromdata processing, and the impact should they occur.

Privacy Risk Assessment

A privacy risk management sub-process for identifying and evaluating
specific privacy risks.

Privacy Risk
Management

A cross-organizational set of processes for identifying, assessing, andresponding to privacy risks.

Problematic Data Action(Adapted from NIST IR
8062 [5])A data action that could cause an adverse effect for individuals.

Processing

See Data Processing.

ProfileA selection of specific Functions, Categories, and Subcategories from theCore that an organization has prioritized to help it manage privacy risk.

Protect-P (Function)

Develop and implement appropriate data processing safeguards.

Provenance (Adaptedfrom NIST IR 8112 [11])Metadata pertaining to the origination or source of specified data.

Risk(NIST SP 800-30 [12])A measure of the extent to which an entity is threatened by a potential
circumstance or event, and typically a function of: (i) the adverse impacts
that would arise if the circumstance or event occurs; and (ii) the
likelihood of occurrence.

Risk Management

The process of identifying, assessing, and responding to risk.

Risk Tolerance(NIST SP 800-39 [6])The level of risk or degree of uncertainty that is acceptable toorganizations.

Subcategory

The further divisions of a Category into specific outcomes of technicaland/or management activities.

30

NIST Privacy Framework

January 16, 2020

Appendix C: Acronyms
This appendix defines selected acronyms used in the publication.
IEC
IR
ISO
IT
NIST
OASIS
OECD
OMB
PMRM
PRAM
RFC
RFI
SDLC
SP

International Electrotechnical Commission
Interagency or Internal Report
International Organization for Standardization
Information Technology
National Institute of Standards and Technology
Organization for the Advancement of Structured Information Standards
Organisation for Economic Co-operation and Development
Office of Management and Budget
Privacy Management Reference Model and Methodology
Privacy Risk Assessment Methodology
Request for Comment
Request for Information
System Development Life Cycle
Special Publication

31

NIST Privacy Framework

January 16, 2020

Appendix D: Privacy Risk Management Practices
Section 1.2 introduces a number of considerations around privacy risk management, including therelationship between cybersecurity and privacy risk and the role of privacy risk assessment. Thisappendix considers some of the key practices that contribute to successful privacy risk management,
including organizing preparatory resources, determining privacy capabilities, defining privacy
requirements, conducting privacy risk assessments, creating privacy requirements traceability, andmonitoring for changing privacy risks. Category and Subcategory references are included to facilitate useof the Core to support these practices; these references appear in parentheticals.

Organizing Preparatory Resources
The appropriate resources facilitate informed decision-making about privacy risks at all levels of anorganization. As a practical matter, the responsibility for the development of various resources may
belong to different components of an organization. Therefore, a component of an organization
depending on certain resources may find that they either do not exist, or may not sufficiently addressprivacy. In these circumstances, the dependent component can consider the purpose of the resourceand either seek the information through other sources or make the best decision it can with theavailable information. In short, good resources are helpful, but any deficiencies should not prevent
organizational components from making the best risk decisions they can within their capabilities.
The following resources, while not exhaustive, build a foundation for better decision-making.
•Risk management role assignments (GV.PO-P3, GV.PO-P4)
Establishing and enabling cross-organizational understanding of who is accountable and who
has responsibility for privacy risk management as well as other risk management tasks in an
organization supports better coordination and accountability for decision-making. In addition, abroad range of perspectives can improve the process of identifying, assessing, and responding to
privacy risks. A diverse and cross-functional team can help to identify a more comprehensive
range of risks to individuals’ privacy, and to select a wider set of mitigations. Determining whichroles to include in the risk management discussions depends on organizational context andmakeup, although collaboration between an organization’s privacy and cybersecurity programs
will be important. If one individual is being assigned to multiple roles, managing potential
conflicts of interest should be considered.

•Enterprise risk management strategy (GV.RM-P)
An organization’s enterprise risk management strategy helps to align an organization’s mission
and values with organizational risk tolerance, assumptions, constraints, and priorities.
Limitations on resources to achieve mission or business objectives and to manage a broad
portfolio of risks will likely require trade-offs. Enabling personnel involved in the privacy risk
management process to better understand an organization’s risk tolerance should help to guidedecisions about how to allocate resources and improve decisions around risk response.

•

Key stakeholders (GV.PO-P4, ID.DE-P)
Privacy stakeholders are those who have an interest or concern in the privacy outcomes of thesystem, product, or service. For example, legal concerns likely focus on whether the system,
product, or service is operating in a way that would cause an organization to be out ofcompliance with privacy laws or regulations or its business agreements. Business owners thatwant to maximize usage may be concerned about loss of trust in the system, product, or service
32

NIST Privacy Framework

January 16, 2020

due to poor privacy. Individuals whose data are being processed or who are interacting with thesystem, product, or service will be interested in not experiencing problems or adverse
consequences. Understanding the stakeholders and the types of privacy outcomes they areinterested in will facilitate system/product/service design that appropriately addresses
stakeholders’ needs.
•

Organizational-level privacy requirements (GV.PO-P)
Organizational-level privacy requirements are a means of expressing the legal obligations,privacy values, and policies to which an organization intends to adhere. Understanding theserequirements is key to ensuring that the system/product/service design complies with its
obligations. Organizational-level privacy requirements may be derived from a variety of sources,
including:•oLegal environment (e.g., laws, regulations, contracts);oOrganizational policies or cultural values;oRelevant standards; andoPrivacy principles.

System/product/service design artifacts (ID.BE-P3)
Design artifacts may take many forms such as system design architectures or data flow
diagrams. These artifacts help an organization determine how its systems, products, andservices will operate. Therefore, they can help privacy programs understand how systems,
products, and services need to function so that controls or measures that help to mitigate
privacy risk can be selected and implemented in ways that maintain functionality while
protecting privacy.

•

Data maps (ID.IM-P)
Data maps illustrate data processing and individuals’ interactions with systems, products, andservices. A data map shows the data processing environment and includes the components
through which data are being processed or with which individuals are interacting, the owners or
operators of the components, and discrete data actions and the specific data elements being
processed. Data maps can be illustrated in different ways, and the level of detail may vary basedon an organization’s needs. A data map can be overlaid on existing system/product/service
design artifacts for convenience and ease of communication between organizational
components. As discussed below, a data map is an important artifact in privacy risk assessment.

Determining Privacy Capabilities
Privacy capabilities can be used to describe the system, product, or service property or feature that
achieves the desired privacy outcome (e.g., “the service enables data minimization”). The security
objectives confidentiality, integrity, and availability along with security requirements are used to informthe security capabilities for a system, product, or service. As set forth in Table 3, an additional set ofprivacy engineering objectives can support the determination of privacy capabilities. An organization
may also use the privacy engineering objectives as a high-level prioritization tool. Systems, products, orservices that are low in predictability, manageability, or disassociability may be a signal of increased
privacy risk, and therefore merit a more comprehensive privacy risk assessment.
33

NIST Privacy Framework

January 16, 2020

In determining privacy capabilities, an organization may consider which of the privacy engineering andsecurity objectives are most important with respect to its mission or business needs, risk tolerance, andorganizational-level privacy requirements (see Organizing Preparatory Resources above). Not all of theobjectives may be equally important, or trade-offs may be necessary among them. Although the privacy
capabilities inform the privacy risk assessment by supporting risk prioritization decisions, the privacy
capabilities may also be informed by the risk assessment and adjusted to support the management ofspecific privacy risks or address changes in the environment, including design changes to the system,
product, or service.

Privacy Engineering
Objectives

Table 3: Privacy Engineering and Security Objectives 18
Objective

Definition

Predictability

Enabling reliable assumptions by individuals,
owners, and operators about data and theirprocessing by a system
Providing the capability for granularadministration of data, including collection,
alteration, deletion, and selective disclosure
Enabling the processing of data or events
without association to individuals or devices
beyond the operational requirements of thesystemPreserving authorized restrictions on
information access and disclosure, includingmeans for protecting personal privacy andproprietary information
Guarding against improper information
modification or destruction; includes ensuring
information non-repudiation and authenticity
Ensuring timely and reliable access to and useof information

Manageability
Disassociability

Security Objectives

Confidentiality

Integrity
Availability

Principal Related
Functions from thePrivacy Framework Core
Identify-P, Govern-P,
Control-P, CommunicateP, Protect-P
Identify-P, Govern-P,
Control-P
Identify-P, Govern-P,
Control-P
Identify-P, Govern-P,
Protect-P
Identify-P, Govern-P,
Protect-P
Identify-P, Govern-P,
Protect-P

Defining Privacy Requirements
Privacy requirements specify the way a system, product, or service needs to function to meetstakeholders’ desired privacy outcomes (e.g., “the application is configured to allow users to selectspecific data elements”). To define privacy requirements, consider organizational-level privacy
requirements (see Organizing Preparatory Resources above) and the outputs of a privacy risk
assessment. This process helps an organization to answer two questions: 1) What can a system, product,or service do with data processing and interactions with individuals? 2) What should it do? Then an
organization can allocate resources to design a system, product, or service in a way that achieves thedefined requirements. Ultimately, defining privacy requirements can lead to the development of18

The privacy engineering objectives are adapted from NIST IR 8062 [5]. The security objectives are from NIST SP
800-37, Rev. 2 [7].

34

NIST Privacy Framework

January 16, 2020

systems, products, and services that are more mindful of individuals’ privacy, and are based on informed
risk decisions.

Conducting Privacy Risk Assessments
Conducting a privacy risk assessment helps an organization to identify privacy risks engendered by thesystem, product, or service and prioritize them to be able to make informed decisions about how to
respond to the risks (ID.RA-P, GV.RM-P). Methodologies for conducting privacy risk assessments mayvary, but organizations should consider the following characteristics: 19•

Risk model (ID.RA-P, GV.MT-P1)
Risk models define the risk factors to be assessed and the relationships among those factors. 20 If
an organization is not using a pre-defined risk model, an organization should clearly define
which risk factors it will be assessing and the relationships among these factors. Althoughcybersecurity has a widely used risk model
based on the risk factors of threats,
Privacy Risk Factors:
vulnerabilities, likelihood, and impact,
Problematic Data Action | Likelihood | Impact
there is not one commonly accepted
privacy risk model. NIST has developed aprivacy risk model to calculate risk based on the likelihood of a problematic data action
multiplied by the impact of a problematic data action; each of the three risk factors are
explained below.

19
20
21

22

o

A problematic data action is any action a system takes to process data that could result in a
problem for individuals. Organizations consider the type of problems that are relevant to
the population of individuals. Problems can take any form and may consider the experienceof individuals. 21oLikelihood is defined as a contextual analysis that a data action is likely to create a problem
for a representative set of individuals. Context can include organizational factors (e.g.,geographic location, the public perception about participating organizations with respect toprivacy), system factors (e.g., the nature and history of individuals’ interactions with thesystem, visibility of data processing to individuals and third parties), or individual factors(e.g., individuals’ demographics, privacy interests or perceptions, data sensitivity). 22 A data
map can help with this contextual analysis (see Organizing Preparatory Resources).

oImpact is an analysis of the costs should the problem occur. As noted in section 1.2,
organizations do not experience these problems directly. Moreover, individuals’ experiences
may be subjective. Thus, impact may be difficult to assess accurately. Organizations should

NIST has developed a Privacy Risk Assessment Methodology (PRAM) that can help organizations identify,
assess, and respond to privacy risks. It is comprised of a set of worksheets available at [3].
See NIST SP 800-30, Rev. 1, Guide for Conducting Risk Assessments [12] at p. 8.
As part of its PRAM, NIST has created an illustrative catalog of problematic data actions and problems forconsideration [3]. Other organizations may have created additional problem sets, or may refer to them asadverse consequences or harms.
See NIST PRAM for more information about contextual factors. Id. at Worksheet 2.

35

NIST Privacy Framework

January 16, 2020

consider the best means of internalizing impact to individuals in order to appropriately
prioritize and respond to privacy risks. 23•

Assessment approach
The assessment approach is the mechanism by which identified risks are prioritized. Assessment
approaches can be categorized as quantitative, semi-quantitative, or qualitative. 24 25•

Prioritizing risks (ID.RA-P4)
Given the applicable limits of an organization’s resources, organizations prioritize the risks tofacilitate communication about how to respond. 26•

Responding to risks (ID.RA-P5)
As described in section 1.2.2, response approaches include mitigation, transfer/sharing,
avoidance, or acceptance. 27

Creating Privacy Requirements Traceability
Once an organization has determined which risks to mitigate, it can refine the privacy requirements andthen select and implement controls (i.e., technical, physical, and/or policy safeguards) to meet therequirements. 28 An organization may use a variety of sources to select controls, such as NIST SP 800-53,
Security and Privacy Controls for Information Systems and Organizations. 29 After implementation, an
organization iteratively assesses the controls for their effectiveness in meeting the privacy requirements
and managing privacy risk. In this way, an organization creates traceability between the controls and theprivacy requirements, and demonstrates accountability between its systems, products, and services andits organizational privacy goals.

Monitoring Change
Privacy risk management is not a static process. An organization monitors how changes in its businessenvironment—including new laws and regulations and emerging technologies—and corresponding
changes to its systems, products, and services may be affecting privacy risk, and iteratively uses thepractices in this appendix to adjust accordingly. (GV.MT-P1)

23

24
25
26
27
28
29

The NIST PRAM uses organizational costs such as non-compliance costs, direct business costs, reputationalcosts, and internal culture costs as drivers for considering how to assess individual impact. Id. at Worksheet 3,
Impact Tab.
See NIST SP 800-30, Rev. 1, Guide for Conducting Risk Assessments at [12] p. 14.
The NIST PRAM uses a semi-quantitative approach based on a scale of 1-10.
The NIST PRAM provides various prioritization representations, including a heat map. See [3] Worksheet 3.
The NIST PRAM provides a process for responding to prioritized privacy risks. Id. at Worksheet 4.
See NIST SP 800-37, Rev. 2 [7].
See NIST SP 800-53 as updated [10].

36NIST Privacy Framework

January 16, 2020

Appendix E: Implementation Tiers Definitions
The four Tiers summarized below are each defined with four elements:

Tier 1: Partial•

Privacy Risk Management Process – Organizational privacy risk management practices are notformalized, and risk is managed in an ad hoc and sometimes reactive manner. Prioritization ofprivacy activities may not be directly informed by organizational risk management priorities,
privacy risk assessments, or mission or business objectives.

•

Integrated Privacy Risk Management Program – There is limited awareness of privacy risk at
the organizational level. The organization implements privacy risk management on an irregular,case-by-case basis due to varied experience or information gained from outside sources. The
organization may not have processes that enable the sharing of information about dataprocessing and resulting privacy risks within the organization.

•

Data Processing Ecosystem Relationships – There is limited understanding of an organization’srole(s) in the larger ecosystem with respect to other entities (e.g., buyers, suppliers, service
providers, business associates, partners). The organization does not have processes for
identifying how privacy risks may proliferate throughout the ecosystem or for communicating
privacy risks or requirements to other entities in the ecosystem.

•

Workforce – Some personnel may have a limited understanding of privacy risks or privacy risk
management processes, but have no specific privacy responsibilities. If available, privacy
training is ad hoc and the content is not kept current with best practices.

Tier 2: Risk Informed•

Privacy Risk Management Process – Risk management practices are approved by management
but may not be established as organization-wide policy. Prioritization of privacy activities is
directly informed by organizational risk management priorities, privacy risk assessments, or
mission or business objectives.

•

Integrated Privacy Risk Management Program – There is an awareness of privacy risk at theorganizational level, but an organization-wide approach to managing privacy risk has not been
established. Information about data processing and resulting privacy risks is shared within theorganization on an informal basis. Consideration of privacy in organizational objectives andprograms may occur at some but not all levels of the organization. Privacy risk assessment
occurs, but is not typically repeatable or reoccurring.

•

Data Processing Ecosystem Relationships – There is some understanding of an organization’srole(s) in the larger ecosystem with respect to other entities (e.g., buyers, suppliers, service
providers, business associates, partners). The organization is aware of the privacy ecosystemrisks associated with the products and services it provides and uses, but does not act
consistently or formally upon those risks.

•Workforce – There are personnel with specific privacy responsibilities, but they may have nonprivacy responsibilities as well. Privacy training is conducted regularly for privacy personnel,
although there is no consistent process for updates on best practices.

37

NIST Privacy Framework

January 16, 2020

Tier 3: Repeatable•

Privacy Risk Management Process – The organization’s risk management practices are formallyapproved and expressed as policy. Organizational privacy practices are regularly updated basedon the application of risk management processes to changes in mission or business objectives
and a changing risk, policy, and technology landscape.

•Integrated Privacy Risk Management Program – There is an organization-wide approach to
manage privacy risk. Risk-informed policies, processes, and procedures are defined,
implemented as intended, and reviewed. Consistent methods are in place to respond effectively
to changes in risk. The organization consistently and accurately monitors privacy risk. Seniorprivacy and non-privacy executives communicate regularly regarding privacy risk. Senior
executives ensure consideration of privacy through all lines of operation in the organization.

•

Data Processing Ecosystem Relationships – The organization understands its role(s),dependencies, and dependents in the larger ecosystem and may contribute to the community’s
broader understanding of risks. The organization is aware of the privacy ecosystem risks
associated with the products and services it provides and it uses. Additionally, it usually acts
formally upon those risks, including mechanisms such as written agreements to communicate
privacy requirements, governance structures, and policy implementation and monitoring.

•

Workforce – Dedicated privacy personnel possess the knowledge and skills to perform their
appointed roles and responsibilities. There is regular, up-to-date privacy training for all
personnel.

Tier 4: Adaptive•

Privacy Risk Management Process – The organization adapts its privacy practices based on
lessons learned from privacy events, and identification of new privacy risks. Through a processof continuous improvement incorporating advanced privacy technologies and practices, theorganization actively adapts to a changing policy and technology landscape and responds in atimely and effective manner to evolving privacy risks.

•Integrated Privacy Risk Management Program – There is an organization-wide approach to
managing privacy risk that uses risk-informed policies, processes, and procedures to address
problematic data actions. The relationship between privacy risk and organizational objectives isclearly understood and considered when making decisions. Senior executives monitor privacy
risk in the same context as cybersecurity risk, financial risk, and other organizational risks. The
organizational budget is based on an understanding of the current and predicted risk
environment and risk tolerance. Business units implement executive vision and analyze systemlevel risks in the context of the organizational risk tolerances. Privacy risk management is part ofthe organizational culture and evolves from lessons learned and continuous awareness of dataprocessing and resulting privacy risks. The organization can quickly and efficiently account forchanges to business/mission objectives in how risk is approached and communicated.

•

Data Processing Ecosystem Relationships – The organization understands its role(s),dependencies, and dependents in the larger ecosystem and contributes to the community’s
broader understanding of risks. The organization uses real-time or near-real-time information tounderstand and consistently act upon privacy ecosystem risks associated with the products andservices it provides and it uses. Additionally, it communicates proactively, using formal (e.g.,agreements) and informal mechanisms to develop and maintain strong ecosystem relationships.
38

NIST Privacy Framework•

January 16, 2020

Workforce – The organization has specialized privacy skillsets throughout the organizational
structure; personnel with diverse perspectives contribute to the management of privacy risks.
There is regular, up-to-date, specialized privacy training for all personnel. Personnel at all levels
understand the organizational privacy values and their role in maintaining them.

39