Version 1.0

NIST PRIVACY FRAMEWORK: A TOOL FOR 

IMPROVING PRIVACY THROUGH ENTERPRISE 

RISK MANAGEMENT

January 16, 2020

The contents of this document do not have the force and effect of 

law and are not meant to bind the public in any way.
NIST Privacy Framework January 16, 2020

i

Executive Summary

For more than two decades, the Internet and associated information technologies have driven 

unprecedented innovation, economic value, and improvement in social services. Many of these benefits 

are fueled by data about individuals that flow through a complex ecosystem. As a result, individuals may 

not be able to understand the potential consequences for their privacy as they interact with systems, 

products, and services. At the same time, organizations may not realize the full extent of these 

consequences for individuals, for society, or for their enterprises, which can affect their brands, their 

bottom lines, and their future prospects for growth.

Following a transparent, consensus-based process including both private and public stakeholders to 

produce this voluntary tool, the National Institute of Standards and Technology (NIST) is publishing this

Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management (Privacy 

Framework), to enable better privacy engineering practices that support privacy by design concepts and 

help organizations protect individuals’ privacy. The Privacy Framework can support organizations in:

• Building customers’ trust by supporting ethical decision-making in product and service design or 

deployment that optimizes beneficial uses of data while minimizing adverse consequences for 

individuals’ privacy and society as a whole;1

• Fulfilling current compliance obligations, as well as future-proofing products and services to 

meet these obligations in a changing technological and policy environment; and

• Facilitating communication about privacy practices with individuals, business partners,

assessors, and regulators.

Deriving benefits from data while simultaneously managing risks to individuals’ privacy is not well-suited 

to one-size-fits-all solutions. Like building a house, where homeowners make layout and design choices 

while relying on a well-engineered foundation, privacy protection should allow for individual choices, as 

long as effective privacy risk mitigations are already engineered into products and services. The Privacy 

Framework—through a risk- and outcome-based approach—is flexible enough to address diverse 

privacy needs, enable more innovative and effective solutions that can lead to better outcomes for 

individuals and organizations, and stay current with technology trends, such as artificial intelligence and 

the Internet of Things.

The Privacy Framework follows the structure of the Framework for Improving Critical Infrastructure 

Cybersecurity (Cybersecurity Framework) [1] to facilitate the use of both frameworks together. Like the 

Cybersecurity Framework, the Privacy Framework is composed of three parts: Core, Profiles, and 

Implementation Tiers. Each component reinforces privacy risk management through the connection 

between business and mission drivers, organizational roles and responsibilities, and privacy protection 

activities.

• The Core enables a dialogue—from the executive level to the implementation/operations 

level—about important privacy protection activities and desired outcomes.

• Profiles enable the prioritization of the outcomes and activities that best meet organizational 

privacy values, mission or business needs, and risks.

 

1 There is no objective standard for ethical decision-making; it is grounded in the norms, values, and legal 

expectations in a given society.
NIST Privacy Framework January 16, 2020

ii

• Implementation Tiers support decision-making and communication about the sufficiency of 

organizational processes and resources to manage privacy risk.

In summary, the Privacy Framework is intended to help organizations build better privacy foundations 

by bringing privacy risk into parity with their broader enterprise risk portfolio.

Acknowledgements

This publication is the result of a collaborative effort between NIST and organizational and individual 

stakeholders in the public and private sectors. In developing the Privacy Framework, NIST has relied 

upon three public workshops, a request for information (RFI), a request for comment (RFC), five 

webinars, and hundreds of direct interactions with stakeholders.2 NIST acknowledges and thanks all of 

those who have contributed to this publication.

 

2 A complete development archive can be found at https://www.nist.gov/privacy-framework.
NIST Privacy Framework January 16, 2020

iii

Table of Contents

Executive Summary............................................................................................................................ i

Acknowledgements............................................................................................................................ii

1.0 Privacy Framework Introduction ........................................................................................1

Overview of the Privacy Framework...................................................................................................... 2

Privacy Risk Management...................................................................................................................... 2

1.2.1 Cybersecurity and Privacy Risk Management................................................................................... 3

1.2.2 Privacy Risk Assessment.................................................................................................................... 4

Document Overview .............................................................................................................................. 5

2.0 Privacy Framework Basics ..................................................................................................6

Core ........................................................................................................................................................ 6

Profiles.................................................................................................................................................... 8

Implementation Tiers............................................................................................................................. 8

3.0 How to Use the Privacy Framework....................................................................................9

Mapping to Informative References...................................................................................................... 9

Strengthening Accountability............................................................................................................... 10

Establishing or Improving a Privacy Program ...................................................................................... 11

Applying to the System Development Life Cycle ................................................................................. 12

Using within the Data Processing Ecosystem ...................................................................................... 13

Informing Buying Decisions.................................................................................................................. 14

References.......................................................................................................................................15

Appendix A: Privacy Framework Core ...............................................................................................17

Appendix B: Glossary .......................................................................................................................28

Appendix C: Acronyms......................................................................................................................31

Appendix D: Privacy Risk Management Practices ..............................................................................32

Appendix E: Implementation Tiers Definitions...................................................................................37

List of Figures

Figure 1: Core, Profiles, and Implementation Tiers.............................................................................................2

Figure 2: Cybersecurity and Privacy Risk Relationship ........................................................................................3

Figure 3: Relationship Between Privacy Risk and Organizational Risk .................................................................4

Figure 4: Privacy Framework Core Structure......................................................................................................6

Figure 5: Using Functions to Manage Cybersecurity and Privacy Risks.................................................................7

Figure 6: Relationship Between Core and Profiles..............................................................................................8

Figure 7: Notional Collaboration and Communication Flows Within an Organization ........................................ 10

Figure 8: Data Processing Ecosystem Relationships.......................................................................................... 13

List of Tables

Table 1: Privacy Framework Function and Category Unique Identifiers............................................................. 19

Table 2: Privacy Framework Core.................................................................................................................... 20

Table 3: Privacy Engineering and Security Objectives....................................................................................... 34
NIST Privacy Framework January 16, 2020

1

1.0 Privacy Framework Introduction

For more than two decades, the Internet and associated information technologies have driven 

unprecedented innovation, economic value, and access to social services. Many of these benefits are 

fueled by data about individuals that flow through a complex ecosystem. As a result, individuals may not 

be able to understand the potential consequences for their privacy as they interact with systems, 

products, and services. Organizations may not fully realize the consequences either. Failure to manage 

privacy risks can have direct adverse consequences at both the individual and societal levels, with 

follow-on effects on organizations’ brands, bottom lines, and future prospects for growth. Finding ways 

to continue to derive benefits from data processing while simultaneously protecting individuals’ privacy 

is challenging, and not well-suited to one-size-fits-all solutions.

Privacy is challenging because not only is it an all-encompassing concept that helps to safeguard 

important values such as human autonomy and dignity, but also the means for achieving it can vary.

3 For 

example, privacy can be achieved through seclusion, limiting observation, or individuals’ control of 

facets of their identities (e.g., body, data, reputation).

4 Moreover, human autonomy and dignity are not 

fixed, quantifiable constructs; they are filtered through cultural diversity and individual differences. This

broad and shifting nature of privacy makes it difficult to communicate clearly about privacy risks within 

and between organizations and with individuals. What has been missing is a common language and 

practical tool that is flexible enough to address diverse privacy needs.

This voluntary NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk 

Management (Privacy Framework) is intended to be widely usable by organizations of all sizes and 

agnostic to any particular technology, sector, law, or jurisdiction. Using a common approach—adaptable

to any organization’s role(s) in the data processing ecosystem—the Privacy Framework’s purpose is to

help organizations manage privacy risks by:

• Taking privacy into account as they design and deploy systems, products, and services that 

affect individuals;

• Communicating about their privacy practices; and

• Encouraging cross-organizational workforce collaboration—for example, among executives, 

legal, and information technology (IT)—through the development of Profiles, selection of Tiers, 

and achievement of outcomes.

 

3 Autonomy and dignity are concepts covered in the United Nations Universal Declaration of Human Rights at 

https://www.un.org/en/universal-declaration-human-rights/.

4 There are many publications that provide an in-depth treatment on the background of privacy or different 

aspects of the concept. For two examples, see Solove D (2010) Understanding Privacy (Harvard University 

Press, Cambridge, MA), https://ssrn.com/abstract=1127888; and Selinger E, Hartzog W (2017) Obscurity and 

Privacy, Spaces for the Future: A Companion to Philosophy of Technology, eds Pitt J, Shew A (Taylor & Francis, 

New York, NY), Chapter 12, 1st Ed., https://doi.org/10.4324/9780203735657.
NIST Privacy Framework January 16, 2020

2

Overview of the Privacy Framework 

As shown in Figure 1, the Privacy 

Framework is composed of three 

parts: Core, Profiles, and 

Implementation Tiers. Each 

component reinforces how 

organizations manage privacy risk

through the connection between 

business or mission drivers, 

organizational roles and 

responsibilities, and privacy 

protection activities. As further 

explained in section 2:

• The Core is a set of privacy 

protection activities and 

outcomes that allows for 

communicating prioritized 

privacy protection 

activities and outcomes 

across an organization from the 

executive level to the implementation/operations level. The Core is further divided into key 

Categories and Subcategories—which are discrete outcomes—for each Function.

• A Profile represents an organization’s current privacy activities or desired outcomes. To develop 

a Profile, an organization can review all of the outcomes and activities in the Core to determine 

which are most important to focus on based on business or mission drivers, data processing 

ecosystem role(s), types of data processing, and individuals’ privacy needs. An organization can 

create or add Functions, Categories, and Subcategories as needed. Profiles can be used to 

identify opportunities for improving privacy posture by comparing a “Current” Profile (the “as 

is” state) with a “Target” Profile (the “to be” state). Profiles can be used to conduct selfassessments and to communicate within an organization or between organizations about how 

privacy risks are being managed.

• Implementation Tiers (“Tiers”) provide a point of reference on how an organization views 

privacy risk and whether it has sufficient processes and resources in place to manage that risk. 

Tiers reflect a progression from informal, reactive responses to approaches that are agile and 

risk informed. When selecting Tiers, an organization should consider its Target Profile(s) and 

how achievement may be supported or hampered by its current risk management practices, the 

degree of integration of privacy risk into its enterprise risk management portfolio, its data 

processing ecosystem relationships, and its workforce composition and training program.

Privacy Risk Management

While some organizations have a robust grasp of privacy risk management, a common understanding of 

many aspects of this topic is still not widespread.

5 To promote broader understanding, this section 

covers concepts and considerations that organizations may use to develop, improve, or communicate

 

5 See Summary Analysis of the Responses to the NIST Privacy Framework Request for Information [2] at p. 7.

The Core provides an increasingly granular set 

of activities and outcomes that enable an 

organizational dialogue about managing privacy 

risk

Profiles are a selection of 

specific Functions, 

Categories, and 

Subcategories from the 

Core that an organization 

has prioritized to help it 

manage privacy risk

CURRENT

TARGET

Implementation Tiers support communication 

about whether an organization has sufficient 

processes and resources in place to manage 

privacy risk and achieve its Target Profile

Figure 1: Core, Profiles, and Implementation Tiers
NIST Privacy Framework January 16, 2020

3

about privacy risk management. Appendix D provides additional information on key privacy risk 

management practices.

1.2.1 Cybersecurity and Privacy Risk Management

Since its release in 2014, the Cybersecurity 

Framework has helped organizations to 

communicate and manage cybersecurity 

risk. [1] While managing cybersecurity 

risk contributes to managing privacy risk, 

it is not sufficient, as privacy risks can 

also arise by means unrelated to 

cybersecurity incidents, as illustrated by

Figure 2. Having a general understanding 

of the different origins of cybersecurity 

and privacy risks is important for

determining the most effective solutions to 

address the risks.

The Privacy Framework approach to privacy 

risk is to consider privacy events as potential problems individuals could experience arising from system, 

product, or service operations with data, whether in digital or non-digital form, through a complete life 

cycle from data collection through disposal.

The Privacy Framework describes these data operations in the singular as a data action and collectively 

as data processing. The problems individuals can experience as a result of data 

processing can be expressed in various ways, but NIST describes them as 

ranging from dignity-type effects such as embarrassment or stigmas to more 

tangible harms such as discrimination, economic loss, or physical harm.6

The basis for the problems that individuals may experience can vary. As 

depicted in Figure 2, problems arise as an adverse effect of data processing 

that organizations conduct to meet their mission or business objectives. An 

example is the concerns that certain communities had about the installation of 

“smart meters” as part of the Smart Grid, a nationwide technological effort to 

increase energy efficiency.7 The ability of these meters to collect, record, and 

distribute highly granular information about household electrical use could 

provide insight into people’s behavior inside their homes.8 The meters were 

 

6 NIST has created an illustrative catalog of problems for use in privacy risk assessment. See NIST Privacy Risk 

Assessment Methodology [3]. Other organizations may have created other categories of problems, or may 

refer to them as adverse consequences or harms.

7 See, for example, NIST Interagency or Internal Report (IR) 7628 Revision 1 Volume 1, Guidelines for Smart Grid 

Cybersecurity: Volume 1 – Smart Grid Cybersecurity Strategy, Architecture, and High-Level Requirements at [4]

p. 26.

8 See NIST IR 8062, An Introduction to Privacy Engineering and Risk Management in Federal Systems at [5] p. 2. 

For additional types of privacy risks associated with adverse effects on individuals of data processing, see 

Appendix E of NIST IR 8062.

Data Action

A data life cycle 

operation, including, 

but not limited to 

collection, retention, 

logging, generation, 

transformation, use, 

disclosure, sharing, 

transmission, and 

disposal.

Data Processing

The collective set of 

data actions.

Figure 2: Cybersecurity and Privacy Risk 

Relationship

Cybersecurity 

Risks 

Privacy 

Risks

associated with 

cybersecurity 

incidents arising from 

loss of confidentiality, 

integrity, or 

availability

associated with 

privacy events 

arising from data 

processing

cyber

securityrelated 

privacy 

events
NIST Privacy Framework January 16, 2020

4

operating as intended, but the data processing could lead to people feeling surveilled.

In an increasingly connected world, some problems can arise simply from individuals’ interactions with 

systems, products, and services, even when the data being processed is not directly linked to identifiable 

individuals. For example, smart cities technologies could be used to alter or influence people’s behavior 

such as where or how they move through the city.

9 Problems also can arise where there is a loss of 

confidentiality, integrity, or availability at some point in the data processing, such as data theft by 

external attackers or the unauthorized access or use of data by employees. Figure 2 shows these types 

of cybersecurity-related privacy events as the overlap between privacy and cybersecurity risks.

Once an organization can identify the likelihood of any given problem arising from the data processing, 

which the Privacy Framework refers to as a problematic data action, it can assess the impact should the 

problematic data action occur. This impact assessment is where privacy risk and organizational risk

intersect. Individuals, whether singly or in groups (including at a societal level) experience the direct 

impact of problems. As a result of the problems individuals experience, an organization may experience 

impacts such as noncompliance costs, revenue loss arising from customer abandonment of products and 

services, or harm to its external brand reputation or internal culture. Organizations commonly manage 

these types of impacts at the enterprise risk management level; by connecting problems that individuals 

experience to these well-understood organizational impacts, organizations can bring privacy risk into 

parity with other risks they are managing in their broader portfolio and drive more informed decisionmaking about resource allocation to strengthen privacy programs. Figure 3 illustrates this relationship 

between privacy risk and organizational risk.

1.2.2 Privacy Risk Assessment

Privacy risk management is a cross-organizational set of processes that helps organizations to 

understand how their systems, products, and services may create problems for individuals and how to 

develop effective solutions to manage such risks. Privacy risk assessment is a sub-process for identifying 

and evaluating specific privacy risks. In general, privacy risk assessments produce the information that 

can help organizations to weigh the benefits of the data processing against the risks and to determine 

the appropriate response—sometimes referred to as proportionality.10 Organizations may choose to 

 

9 See Newcombe T (2016) Security, Privacy, Governance Concerns About Smart City Technologies Grow.

Government Technology. Available at http://www.govtech.com/Security-Privacy-Governance-Concerns-AboutSmart-City-Technologies-Grow.html.

10 See European Data Protection Supervisor (2019) Necessity & Proportionality. Available at 

https://edps.europa.eu/data-protection/our-work/subjects/necessity-proportionality_en. 

Problem

arises from data 

processing

Individual

experiences direct impact 

(e.g., embarrassment, 

discrimination, economic 

loss)

Organization

resulting impact

(e.g., customer abandonment, 

noncompliance costs, harm to 

reputation or internal culture)

Figure 3: Relationship Between Privacy Risk and Organizational Risk
NIST Privacy Framework January 16, 2020

5

prioritize and respond to privacy risk in different ways, depending on the potential impact to individuals

and resulting impacts to organizations. Response approaches include:

11

• Mitigating the risk (e.g., organizations may be able to apply technical and/or policy measures to

the systems, products, or services that minimize the risk to an acceptable degree);

• Transferring or sharing the risk (e.g., contracts are a means of sharing or transferring risk to 

other organizations, privacy notices and consent mechanisms are a means of sharing risk with 

individuals);

• Avoiding the risk (e.g., organizations may determine that the risks outweigh the benefits, and 

forego or terminate the data processing); or

• Accepting the risk (e.g., organizations may determine that problems for individuals are minimal 

or unlikely to occur, therefore the benefits outweigh the risks, and it is not necessary to invest 

resources in mitigation).

Privacy risk assessments are particularly important because, as noted above, privacy is a condition that 

safeguards multiple values. The methods for safeguarding these values may differ, and moreover, may 

be in tension with each other. Depending on its objectives, if an organization is trying to achieve privacy

by limiting observation, this may lead to implementing measures such as distributed data architectures 

or privacy-enhancing cryptographic techniques that hide data even from the organization. If an 

organization is also trying to enable individual control, the measures could conflict. For example, if an 

individual requests access to data, the organization may not be able to produce the data if the data have

been distributed or encrypted in ways the organization cannot access. Privacy risk assessments can help 

an organization understand in a given context the values to protect, the methods to employ, and how to 

balance implementation of different types of measures.

Lastly, privacy risk assessments help organizations distinguish between privacy risk and compliance risk.

Identifying if data processing could create problems for individuals, even when an organization may be 

fully compliant with applicable laws or regulations, can help with ethical decision-making in system, 

product, and service design or deployment. Although there is no objective standard for ethical decisionmaking, it is grounded in the norms, values, and legal expectations in a given society. This facilitates

optimizing beneficial uses of data while minimizing adverse consequences for individuals’ privacy and 

society as a whole, as well as avoiding losses of trust that damage organizations’ reputations, slow 

adoption, or cause abandonment of products and services.

See Appendix D for more information on the operational aspects of privacy risk assessment.

Document Overview

The remainder of this document contains the following sections and appendices:

• Section 2 describes the Privacy Framework components: Core, Profiles, and Implementation 

Tiers.

• Section 3 presents examples of how the Privacy Framework can be used.

• The References section lists the references for the document.

 

11 See NIST Special Publication (SP) 800-39, Managing Information Security Risk: Organization, Mission, and 

Information System View [6].
NIST Privacy Framework January 16, 2020

6

• Appendix A presents the Privacy Framework Core in a tabular format: Functions, Categories, 

and Subcategories.

• Appendix B contains a glossary of selected terms.

• Appendix C lists acronyms used in this document.

• Appendix D considers key practices that contribute to successful privacy risk management.

• Appendix E defines the Implementation Tiers.

2.0 Privacy Framework Basics

The Privacy Framework provides a common language for understanding, managing, and communicating 

privacy risk with internal and external stakeholders. It is adaptable to any organization’s role(s) in the 

data processing ecosystem. It can be used to help identify and prioritize actions for reducing privacy risk, 

and it is a tool for aligning policy, business, and technological approaches to managing that risk.

Core

Set forth in Appendix A, the Core 

provides an increasingly granular set of 

activities and outcomes that enable a

dialogue about managing privacy risk. 

As depicted in Figure 4, the Core 

comprises Functions, Categories, and 

Subcategories.

The Core elements work together:

• Functions organize 

foundational privacy activities 

at their highest level. They aid 

an organization in expressing its 

management of privacy risk by understanding and managing data processing, enabling risk 

management decisions, determining how to interact with individuals, and improving by learning 

from previous activities. They are not intended to form a serial path or lead to a static desired 

end state. Rather, the Functions should be performed concurrently and continuously to form or 

enhance an operational culture that addresses the dynamic nature of privacy risk.

• Categories are the subdivisions of a Function into groups of privacy outcomes closely tied to 

programmatic needs and particular activities.

• Subcategories further divide a Category into specific outcomes of technical and/or management 

activities. They provide a set of results that, while not exhaustive, help support achievement of 

the outcomes in each Category.

The five Functions, Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P, defined below, can 

be used to manage privacy risks arising from data processing.12 Protect-P is specifically focused on 

managing risks associated with cybersecurity-related privacy events (e.g., privacy breaches). The 

Cybersecurity Framework, although intended to cover all types of cybersecurity incidents, can be 

 

12 The “-P” at the end of each Function name indicates that it is from the Privacy Framework in order to avoid 

confusion with Cybersecurity Framework Functions.

FUNCTIONS CATEGORIES SUBCATEGORIES

Identify-P

Govern-P

Protect-P

Control-P

Communicate-P

Figure 4: Privacy Framework Core Structure
NIST Privacy Framework January 16, 2020

7

leveraged to further support the 

management of risks associated with 

cybersecurity-related privacy events 

by using the Detect, Respond, and 

Recover Functions. Alternatively,

organizations may use all five of the 

Cybersecurity Framework Functions in 

conjunction with Identify-P, Govern-P, 

Control-P, and Communicate-P to 

collectively address privacy and 

cybersecurity risks. Figure 5 uses the 

Venn diagram from section 1.2.1 to 

demonstrate how the Functions from 

both frameworks can be used in 

varying combinations to manage 

different aspects of privacy and 

cybersecurity risks. The five Privacy Framework Functions are defined as follows:

• Identify-P – Develop the organizational understanding to manage privacy risk for individuals 

arising from data processing.

The activities in the Identify-P Function are foundational for effective use of the Privacy 

Framework. Inventorying the circumstances under which data are processed, understanding the 

privacy interests of individuals directly or indirectly served or affected by an organization, and 

conducting risk assessments enable an organization to understand the business environment in 

which it is operating and identify and prioritize privacy risks.

• Govern-P – Develop and implement the organizational governance structure to enable an 

ongoing understanding of the organization’s risk management priorities that are informed by 

privacy risk.

The Govern-P Function is similarly foundational, but focuses on organizational-level activities 

such as establishing organizational privacy values and policies, identifying legal/regulatory 

requirements, and understanding organizational risk tolerance that enable an organization to 

focus and prioritize its efforts, consistent with its risk management strategy and business needs.

• Control-P – Develop and implement appropriate activities to enable organizations or individuals 

to manage data with sufficient granularity to manage privacy risks.

The Control-P Function considers data processing management from the standpoint of both 

organizations and individuals.

• Communicate-P – Develop and implement appropriate activities to enable organizations and 

individuals to have a reliable understanding and engage in a dialogue about how data are

processed and associated privacy risks.

The Communicate-P Function recognizes that both organizations and individuals may need to 

know how data are processed in order to manage privacy risk effectively.

• Protect-P – Develop and implement appropriate data processing safeguards.

The Protect-P Function covers data protection to prevent cybersecurity-related privacy events,

the overlap between privacy and cybersecurity risk management.

Figure 5: Using Functions to Manage Cybersecurity and 

Privacy Risks

Cybersecurity 

Risks 

Privacy 

Risks Cybersecurityrelated privacy

events IDENTIFY-P

GOVERN-P

CONTROL-P

COMMUNICATE-P

PROTECT-P

RECOVER

DETECT

RESPOND

IDENTIFY

PROTECT

RECOVER

DETECT

RESPOND
NIST Privacy Framework January 16, 2020

8

Profiles

Profiles are a selection of specific Functions, Categories, and Subcategories from the Core that an 

organization has prioritized to help it manage privacy risk. Profiles can be used to describe the current 

state and the desired target state of specific privacy activities. A Current Profile indicates privacy 

outcomes that an organization is currently achieving, while a Target Profile indicates the outcomes 

needed to achieve the desired privacy risk management goals. The differences between the two Profiles 

enable an organization to identify gaps, develop an action plan for improvement, and gauge the 

resources that would be needed (e.g., staffing, funding) to achieve privacy outcomes. This forms the 

basis of an organization’s plan for reducing privacy risk in a cost-effective, prioritized manner. Profiles 

also can aid in communicating risk within and between organizations by helping organizations 

understand and compare the current and desired state of privacy outcomes. 

The Privacy Framework does not 

prescribe Profile templates to allow 

for flexibility in implementation.

Under the Privacy Framework’s riskbased approach, organizations may 

not need to achieve every outcome 

or activity reflected in the Core. 

When developing a Profile, an 

organization may select or tailor the 

Functions, Categories, and 

Subcategories to its specific needs, 

including developing its own 

additional Functions, Categories,

and Subcategories to account for 

unique organizational risks. An 

organization determines these needs by considering its mission or business objectives, privacy values, 

and risk tolerance; role(s) in the data processing ecosystem or industry sector; legal/regulatory 

requirements and industry best practices; risk management priorities and resources; and the privacy 

needs of individuals who are directly or indirectly served or affected by an organization’s systems, 

products, or services. 

As illustrated in Figure 6, there is no specified order of development of Profiles. An organization may 

first develop a Target Profile in order to focus on its desired outcomes for privacy and then develop a 

Current Profile to identify gaps; alternatively, an organization may begin by identifying its current 

activities, and then consider how to adjust these activities for its Target Profile. An organization may 

choose to develop multiple Profiles for different roles, systems, products, or services, or categories of 

individuals (e.g., employees, customers) to enable better prioritization of activities and outcomes where 

there may be differing degrees of privacy risk. Organizations in a certain industry sector or with similar

roles in the data processing ecosystem may coordinate to develop common Profiles.

Implementation Tiers

Tiers support organizational decision-making about how to manage privacy risk by taking into account 

the nature of the privacy risks engendered by an organization’s systems, products, or services and the 

sufficiency of the processes and resources an organization has in place to manage such risks. When 

selecting Tiers, an organization should consider its Target Profile(s) and how achievement may be 

supported or hampered by its current risk management practices, the degree of integration of privacy 

PROFILES

TARGET

CORE

Identify-P

Govern-P

Protect-P

Control-P

Communicate-P

Identify-P

Govern-P

Protect-P

Identify-P

Govern-P

Protect-P

Control-P

Communicate-P

CURRENT

Figure 6: Relationship Between Core and Profiles
NIST Privacy Framework January 16, 2020

9

risk into its enterprise risk management portfolio, its data processing ecosystem relationships, and its 

workforce composition and training program.

There are four distinct Tiers, Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive 

(Tier 4), descriptions of which are in Appendix E. The Tiers represent a progression, albeit not a 

compulsory one. Although organizations at Tier 1 will likely benefit from moving to Tier 2, not all 

organizations need to achieve Tiers 3 or 4 (or may only focus on certain areas of these Tiers). 

Progression to higher Tiers is appropriate when an organization’s processes or resources at its current 

Tier may be insufficient to help it manage its privacy risks. 

An organization can use the Tiers to communicate internally about resource allocations necessary to 

progress to a higher Tier or as general benchmarks to gauge progress in its capability to manage privacy

risks. An organization can also use Tiers to understand the scale of resources and processes of other 

organizations in the data processing ecosystem and how they align with the organization’s privacy risk 

management priorities. Nonetheless, successful implementation of the Privacy Framework is based 

upon achieving the outcomes described in an organization’s Target Profile(s) and not upon Tier 

determination.

3.0 How to Use the Privacy Framework

When used as a risk management tool, the Privacy Framework can assist an organization in its efforts to 

optimize beneficial uses of data and the development of innovative systems, products, and services 

while minimizing adverse consequences for individuals. The Privacy Framework can help organizations

answer the fundamental question, “How are we considering the impacts to individuals as we develop 

our systems, products, and services?” To account for the unique needs of an organization, use of the 

Privacy Framework is flexible, although it is designed to complement existing business and system 

development operations. The decision about how to apply it is left to the implementing organization. 

For example, an organization may already have robust privacy risk management processes, but may use 

the Core’s five Functions as a streamlined way to analyze and articulate any gaps. Alternatively, an 

organization seeking to establish a privacy program can use the Core’s Categories and Subcategories as a 

reference. Other organizations may compare Profiles or Tiers to align privacy risk management priorities 

across different roles in the data processing ecosystem. The variety of ways in which the Privacy 

Framework can be used by organizations should discourage the notion of “compliance with the Privacy 

Framework” as a uniform or externally referenceable concept. The following subsections present a few 

options for use of the Privacy Framework. 

Mapping to Informative References 

Informative references are mappings to Subcategories to provide implementation support, including 

mappings of tools, technical guidance, standards, laws, regulations, and best practices. Crosswalks that 

map the provisions of standards, laws, and regulations to Subcategories can help organizations 

determine which activities or outcomes to prioritize to facilitate compliance. The Privacy Framework is 

technology neutral, but it supports technological innovation because any organization or industry sector 

can develop these mappings as technology and related business needs evolve. By relying on consensusbased standards, guidelines, and practices, the tools and methods available to achieve positive privacy 

outcomes can scale across borders and accommodate the global nature of privacy risks. The use of 

existing and emerging standards will enable economies of scale and drive the development of systems, 

products, and services that meet identified market needs while being mindful of the privacy needs of 

individuals. 
NIST Privacy Framework January 16, 2020

10

Gaps in mappings can also be used to identify where additional or revised standards, guidelines, and 

practices would help an organization to address emerging needs. An organization implementing a given 

Subcategory, or developing a new Subcategory, might discover that there is insufficient guidance for a 

related activity or outcome. To address that need, an organization might collaborate with technology 

leaders and/or standards bodies to draft, develop, and coordinate standards, guidelines, or practices.

A repository of informative references can be found at https://www.nist.gov/privacy-framework. These 

resources can support organizations’ use of the Privacy Framework and achievement of better privacy 

practices.

Strengthening Accountability 

Accountability is generally considered a key privacy principle, although conceptually it is not unique to 

privacy.13 Accountability occurs throughout an organization, and it can be expressed at varying degrees 

of abstraction, for example as a 

cultural value, as governance policies 

and procedures, or as traceability 

relationships between privacy 

requirements and controls. Privacy 

risk management can be a means of 

supporting accountability at all 

organizational levels as it connects 

senior executives, who can

communicate an organization’s 

privacy values and risk tolerance, to

those at the business/process 

manager level, who can collaborate 

on the development and 

implementation of governance 

policies and procedures that support 

organizational privacy values. These 

policies and procedures can then be 

communicated to those at the 

implementation/operations level,

who collaborate on defining the 

privacy requirements that support 

the expression of the policies and 

procedures in an organization’s systems, products, and services. Personnel at the 

 

13 See, e.g., Organisation for Economic Co-operation and Development (OECD) (2013) OECD Guidelines on the 

Protection of Privacy and Transborder Flows of Personal Data, available at 

https://www.oecd.org/internet/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofper

sonaldata.htm; International Organization for Standardization (ISO)/International Electrotechnical Commission 

(IEC) (2011) ISO/IEC 29100:2011 – Information technology – Security techniques – Privacy framework (ISO, 

Geneva, Switzerland), available at 

https://standards.iso.org/ittf/PubliclyAvailableStandards/c045123_ISO_IEC_29100_2011.zip; and Alliance of 

Automobile Manufacturers, Inc., Association of Global Automakers, Inc. (2014) Consumer Privacy Protection 

Principles: Privacy Principles for Vehicle Technologies and Services, available at https://autoalliance.org/wpcontent/uploads/2017/01/Consumer_Privacy_Principlesfor_VehicleTechnologies_Services-03-21-19.pdf.

Figure 7: Notional Collaboration and Communication Flows 

Within an Organization

Business/Process 

Manager Level

Responsibilities:

• Develop 

Profiles

• Allocate budget

• Inform Tier 

selection

Senior 

Executive Level

• Express mission 

priorities, risk 

tolerance, 

organizational 

privacy values, 

and budget

• Accept/decline 

risk decisions 

Responsibilities:

Implementation/

Operations Level

• Implement 

Profiles 

• Monitor 

progress

• Conduct privacy 

risk assessments

Responsibilities:

C O M M U N I C A T I O N

Privacy posture, changes in risk, implementation 

progress, and incident management activities 

 

C O L L A B O R A T I O N

Tier selection and Profile development
NIST Privacy Framework January 16, 2020

11

implementation/operations level also select, implement, and assess controls as the technical and policy 

measures that meet the privacy requirements, and report on progress, gaps and deficiencies, incident 

management, and changing privacy risks so that those at the business/process manager level and the 

senior executives can better understand and respond appropriately. 

Figure 7 provides a graphical representation of this bi-directional collaboration and communication and 

how elements of the Privacy Framework can be incorporated to facilitate the process. In this way, 

organizations can use the Privacy Framework as a tool to support accountability. They can also use the 

Privacy Framework in conjunction with other frameworks and guidance that provide additional practices 

to achieve accountability within and between organizations.

14

Establishing or Improving a Privacy Program

Using a simple model of “ready, set, go” phases, the Privacy Framework can support the creation of a 

new privacy program or improvement of an existing program. As an organization goes through these 

phases, it may use informative references to provide guidance on prioritizing or achieving outcomes. See 

section 3.1 for more information about informative references. In addition, a repository can be found at

https://www.nist.gov/privacy-framework.

Ready 

Effective privacy risk management requires an organization to 

understand its mission or business environment; its legal 

environment; its risk tolerance; the privacy risks engendered by its 

systems, products, or services; and its role(s) in the data processing 

ecosystem. An organization can use the Identify-P and Govern-P

Functions to “get ready” by reviewing the Categories and 

Subcategories, and beginning to develop its Current Profile and 

Target Profile.15 Activities and outcomes such as establishing 

organizational privacy values and policies, determining and 

expressing an organizational risk tolerance, and conducting privacy 

risk assessments (see Appendix D for more information on privacy 

risk assessments) provide a foundation for completing the Profiles 

in “Set.”

Set

An organization completes its Current Profile by indicating which Category and Subcategory outcomes 

from the remaining Functions are being achieved. If an outcome is partially achieved, noting this fact will 

help support subsequent steps by providing baseline information. Informed by the activities under 

Identify and Govern, such as organizational privacy values and policies, organizational risk tolerance, and 

privacy risk assessment results, an organization completes its Target Profile focused on the assessment 

of the Categories and Subcategories describing its desired privacy outcomes. An organization also may 

develop its own additional Functions, Categories, and Subcategories to account for unique 

organizational risks. It may also consider influences and requirements of external stakeholders such as 

 

14 See, e.g., NIST SP 800-37, Rev. 2, Risk Management Framework for Information Systems and Organizations: A 

System Life Cycle Approach for Security and Privacy [7]; and Organization for the Advancement of Structured 

Information Standards (OASIS) (2016) Privacy Management Reference Model and Methodology (PMRM) 

Version 1.0, https://docs.oasis-open.org/pmrm/PMRM/v1.0/PMRM-v1.0.pdf.

15 For additional information, see the “Prepare” step, Section 3.1, NIST SP 800-37, Rev. 2 [7].

A Simplified Method for 

Establishing or Improving 

a Privacy Program

Ready: use the Identify-P 

and Govern-P Functions

to get “ready.”

Set: “set” an action plan 

based on the differences 

between Current and 

Target Profile(s).

Go: “go” forward with 

implementing the action 

plan.
NIST Privacy Framework January 16, 2020

12

business customers and partners when creating a Target Profile. An organization can develop multiple 

Profiles to support its different business lines or processes, which may have different business needs 

and associated risk tolerances.

An organization compares the Current Profile and the Target Profile to determine gaps. Next, it creates a 

prioritized action plan to address gaps—reflecting mission drivers, costs and benefits, and risks—to 

achieve the outcomes in the Target Profile. An organization using the Cybersecurity Framework and the 

Privacy Framework together may develop integrated action plans. It then determines resources, 

including funding and workforce needs, necessary to address the gaps, which can inform the selection of 

an appropriate Tier. Using Profiles in this manner encourages an organization to make informed 

decisions about privacy activities, supports risk management, and enables an organization to perform 

cost-effective, targeted improvements. 

Go

With the action plan “set,” an organization prioritizes which actions to take to address any gaps, and 

then adjusts its current privacy practices in order to achieve the Target Profile.16

An organization can go through the phases nonsequentially as needed to continuously assess and 

improve its privacy posture. For instance, an organization may find that more frequent repetition of the 

Ready phase improves the quality of privacy risk assessments. Furthermore, an organization may 

monitor progress through iterative updates to the Current Profile or the Target Profile to adjust to 

changing risks, subsequently comparing the Current Profile to the Target Profile. 

Applying to the System Development Life Cycle

The Target Profile can be aligned with the system development life cycle (SDLC) phases of plan, design, 

build/buy, deploy, operate, and decommission to support the achievement of the prioritized privacy 

outcomes.

17 Beginning with the plan phase the prioritized privacy outcomes can be transformed into the 

privacy capabilities and requirements for the system, recognizing that requirements are likely to evolve 

during the remainder of the life cycle. A key milestone of the design phase is validating that the privacy 

capabilities and requirements match the needs and risk tolerance of an organization as expressed in the 

Target Profile. That same Target Profile can serve as an internal list to be assessed when deploying the 

system to verify that all privacy capabilities and requirements are implemented. The privacy outcomes 

determined by using the Privacy Framework should then serve as a basis for ongoing operation of the 

system. This includes occasional reassessment, capturing results in a Current Profile, to verify that 

privacy capabilities and requirements are still fulfilled. 

Privacy risk assessments typically focus on the data life cycle, the stages through which data passes, 

often characterized as creation or collection, processing, dissemination, use, storage, and disposition, to 

include destruction and deletion. Aligning the SDLC and the data lifecycle by identifying and 

understanding how data are processed during all stages of the SDLC helps organizations to better 

manage privacy risks and informs the selection and implementation of privacy controls to meet privacy 

requirements.

 

16 NIST SP 800-37, Rev. 2 [7] provides additional information on steps to execute on the action plan, including 

control selection, implementation, and assessment to close any gaps.

17 Within the SDLC, organizations may employ a variety of development methodologies (e.g., waterfall, spiral, or 

agile).
NIST Privacy Framework January 16, 2020

13

Using within the Data Processing Ecosystem

A key factor in the management of 

privacy risk is an entity’s role(s) in the 

data processing ecosystem, which can 

affect not only its legal obligations, but 

also the measures it may take to manage 

privacy risk. As depicted in Figure 8, the 

data processing ecosystem encompasses 

a range of entities and roles that may 

have complex, multi-directional 

relationships with each other and 

individuals. Complexity can increase 

when entities are supported by a chain 

of sub-entities; for example, service 

providers may be supported by a series 

of service providers, or manufacturers 

may have multiple component suppliers. 

Figure 8 displays entities as having 

distinct roles, but some may have 

multiple roles, such as an organization 

providing services to other organizations 

and providing retail products to

consumers. The roles in Figure 8 are intended to be notional classifications. In practice, an entity’s 

role(s) may be legally codified—for example, some laws classify organizations as data controllers or data 

processors—or classifications may be derived from industry sector designations.

By developing one or more Profiles relevant to its role(s), an entity can use the Privacy Framework to 

consider how to manage privacy risk not only with regard to its own priorities, but also in relation to 

how the measures it may take affect other data processing ecosystem entities’ management of privacy 

risk. For example:

• An organization that makes decisions about how to collect and use data about individuals may 

use a Profile to express privacy requirements to an external service provider (e.g., a cloud 

provider to which it is exporting data); the external service provider that processes the data may 

use its Profile to demonstrate the measures it has adopted to process data in line with 

contractual obligations.

• An organization may express its privacy posture through a Current Profile to report results or to 

compare with acquisition requirements. 

• An industry sector may establish a common Profile that can be used by its members to 

customize their own Profiles. 

• A manufacturer may use a Target Profile to determine the capabilities to build into its products 

so that its business customers can meet the privacy needs of their end users. 

• A developer may use a Target Profile to consider how to design an application that enables 

privacy protections when used within other organizations’ system environments. 

The Privacy Framework provides a common language to communicate privacy requirements with 

entities within the data processing ecosystem. The need for this communication can be particularly 

Individuals

Developer

Business 

Associates 

or Partners

Commercial 

Product/

Services

Civil 

Society

Research/

Education

Manufacturer

Public/

Government

Services

Supplier or

Service

Provider

Figure 8: Data Processing Ecosystem Relationships
NIST Privacy Framework January 16, 2020

14

notable when the data processing ecosystem crosses national boundaries, such as with international 

data transfers. Organizational practices that support communication may include: 

• Determining privacy requirements;

• Enacting privacy requirements through formal agreement (e.g., contracts, multi-party 

frameworks);

• Communicating how those privacy requirements will be verified and validated;

• Verifying that privacy requirements are met through a variety of assessment methodologies;

and 

• Governing and managing the above activities.

Informing Buying Decisions

Since either a Current or Target Profile can be used to generate a prioritized list of privacy requirements, 

these Profiles can also be used to inform decisions about buying products and services. By first selecting 

outcomes that are relevant to its privacy goals, an organization then can evaluate partners’ systems, 

products, or services against this outcome. For example, if a device is being purchased for 

environmental monitoring of a forest, manageability may be important to support capabilities for

minimizing the processing of data about people using the forest and should drive a manufacturer 

evaluation against applicable Subcategories in the Core (e.g., CT.DP-P4: system or device configurations 

permit selective collection or disclosure of data elements).

In circumstances where it may not be possible to impose a set of privacy requirements on the supplier, 

the objective should be to make the best buying decision among multiple suppliers, given a carefully 

determined list of privacy requirements. Often, this means some degree of trade-off, comparing 

multiple products or services with known gaps to the Profile. If the system, product, or service 

purchased did not meet all of the objectives described in the Profile, an organization could address the 

residual risk through mitigation measures or other management actions.
NIST Privacy Framework January 16, 2020

15

References

[1] National Institute of Standards and Technology (2018) Framework for Improving Critical 

Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards and Technology, 

Gaithersburg, MD). https://doi.org/10.6028/NIST.CSWP.04162018

[2] National Institute of Standards and Technology (2019) Summary Analysis of the Responses to the 

NIST Privacy Framework Request for Information. (National Institute of Standards and 

Technology, Gaithersburg, MD).

https://www.nist.gov/sites/default/files/documents/2019/02/27/ 

rfi_response_analysis_privacyframework_2.27.19.pdf

[3] National Institute of Standards and Technology (2019) NIST Privacy Risk Assessment 

Methodology (PRAM). (National Institute of Standards and Technology, Gaithersburg, MD).

https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/resources

[4] The Smart Grid Interoperability Panel—Smart Grid Cybersecurity Committee (2014) Guidelines 

for Smart Grid Cybersecurity: Volume 1 - Smart Grid Cybersecurity Strategy, Architecture, and 

High-Level Requirements. (National Institute of Standards and Technology, Gaithersburg, MD),

NIST Interagency or Internal Report (IR) 7628, Rev. 1, Vol. 1.

https://doi.org/10.6028/NIST.IR.7628r1

[5] Brooks SW, Garcia ME, Lefkovitz NB, Lightman S, Nadeau EM (2017) An Introduction to Privacy 

Engineering and Risk Management in Federal Systems. (National Institute of Standards and 

Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8062. 

https://doi.org/10.6028/NIST.IR.8062

[6] Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: 

Organization, Mission, and Information System View. (National Institute of Standards and 

Technology, Gaithersburg, MD). NIST Special Publication (SP) 800-39. 

https://doi.org/10.6028/NIST.SP.800-39

[7] Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: 

A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and 

Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37 Rev. 2.

https://doi.org/10.6028/NIST.SP.800-37r2

[8] Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards 

and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates as 

of December 1, 2017. https://doi.org/10.6028/NIST.SP.800-63-3

[9] Office of Management and Budget (2017) Preparing for and Responding to a Breach of Personally 

Identifiable Information. (The White House, Washington, DC), OMB Memorandum M-17-12, 

January 3, 2017. Available at 

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-

12_0.pdf

[10] Joint Task Force Transformation Initiative (2013) Security and Privacy Controls for Federal 

Information Systems and Organizations. (National Institute of Standards and Technology, 

Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 4, Includes updates as of January 

22, 2015. https://doi.org/10.6028/NIST.SP.800-53r4

[11] Grassi PA, Lefkovitz NB, Nadeau EM, Galluzzo RJ, Dinh AT (2018) Attribute Metadata: A Proposed 

Schema for Evaluating Federated Attributes. (National Institute of Standards and Technology, 

Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8112. 

https://doi.org/10.6028/NIST.IR.8112
NIST Privacy Framework January 16, 2020

16

[12] Joint Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments. 

(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 

800-30, Rev. 1. https://doi.org/10.6028/NIST.SP.800-30r1

[13] “Definitions,” Title 44 U.S. Code, Sec. 3542. 2011 ed. 

https://www.govinfo.gov/app/details/USCODE-2011-title44/USCODE-2011-title44-chap35-

subchapIII-sec3542
NIST Privacy Framework January 16, 2020

17

Appendix A: Privacy Framework Core

This appendix presents the Core: a table of Functions, Categories, and Subcategories that describe 

specific activities and outcomes that can support managing privacy risks when systems, products, and 

services are processing data. 

Note to Users

Risk-based Approach:

• The Core is not a checklist of actions to perform. An organization selects Subcategories 

consistent with its risk strategy to protect individuals’ privacy, as noted in Category 

statements. An organization may not need to achieve every outcome or activity reflected in the 

Core. It is expected that an organization will use Profiles to select and prioritize the Functions, 

Categories, and Subcategories that best meet its specific needs by considering its goals, role(s) in 

the data processing ecosystem or industry sector, legal/regulatory requirements and industry 

best practices, risk management priorities, and the privacy needs of individuals who are directly 

or indirectly served or affected by an organization’s systems, products, or services. 

• It is not obligatory to achieve an outcome in its entirety. An organization may use its Profiles to 

express partial achievement of an outcome, as not all aspects of an outcome may be relevant 

for it to manage privacy risk, or an organization may use a Target Profile to express an aspect of 

an outcome that it does not currently have the capability to achieve.

• It may be necessary to consider multiple outcomes in combination to appropriately manage 

privacy risk. For example, an organization that responds to individuals’ requests for data access 

may select for its Profile both the Subcategory CT.DM-P1: “Data elements can be accessed for 

review” and the Category “Identity Management, Authentication, and Access Control” (PR.AC-P)

to ensure that only the individual to whom the data pertain gets access.

Implementation: The tabular format of the Core is not intended to suggest a specific implementation 

order or imply a degree of importance between the Functions, Categories, and Subcategories. 

Implementation may be nonsequential, simultaneous, or iterative, depending on the SDLC stage, status 

of the privacy program, scale of the workforce, or role(s) of an organization in the data processing 

ecosystem. In addition, the Core is not exhaustive; it is extensible, allowing organizations, sectors, and 

other entities to adapt or add additional Functions, Categories, and Subcategories to their Profiles.

Roles: 

• Ecosystem Roles: The Core is intended to be usable by any organization or entity regardless of 

its role(s) in the data processing ecosystem. Although the Privacy Framework does not classify 

ecosystem roles, an organization should review the Core from its standpoint in the ecosystem. 

An organization’s role(s) may be legally codified—for example, some laws classify organizations 

as data controllers or data processors—or classifications may be derived from industry 

designations. Since Core elements are not assigned by ecosystem role, an organization can use 

its Profiles to select Functions, Categories, and Subcategories that are relevant to its role(s).

• Organizational Roles: Different parts of an organization’s workforce may take responsibility for 

different Categories or Subcategories. For example, the legal department may be responsible for 

carrying out activities under “Governance Policies, Processes, and Procedures” while the IT 

department is working on “Inventory and Mapping.” Ideally, the Core encourages crossorganization collaboration to develop Profiles and achieve outcomes.
NIST Privacy Framework January 16, 2020

18

Scalability: Certain aspects of outcomes may be ambiguously worded. For example, outcomes may 

include terms like “communicated” or “disclosed” without stating to whom the communications or 

disclosures are being made. The ambiguity is intentional to allow for a wide range of organizations with 

different use cases to determine what is appropriate or required in a given context.

Resource Repository: Standalone resources that can provide more information on how to prioritize or 

achieve outcomes can be found at https://www.nist.gov/privacy-framework.

Cybersecurity Framework Alignment: 

• As noted in section 2.1, organizations can use the five Privacy Framework Functions—Identify-P, 

Govern-P, Control-P, Communicate-P, and Protect-P—to manage privacy risks arising from data 

processing. Protect-P is specifically focused on managing risks associated with security-related 

privacy events (e.g., privacy breaches). To further support the management of risks associated 

with security-related privacy events, organizations may choose to use Detect, Respond, and 

Recover Functions from the Cybersecurity Framework. For this reason, these Functions are 

included in Table 1, but are greyed out. Alternatively, organizations may use all five of the 

Cybersecurity Framework Functions in conjunction with Identify-P, Govern-P, Control-P, and 

Communicate-P to collectively address privacy and security risks. See Figure 5 for an illustrated 

example of how the Functions from both frameworks can be used in varying combinations to 

manage different aspects of privacy and cybersecurity risks.

• Certain Functions, Categories, or Subcategories may be identical to or have been adapted from 

the Cybersecurity Framework. The following legend can be used to identify this relationship in 

Table 2. A complete crosswalk between the two frameworks can be found in the resource 

repository at https://www.nist.gov/privacy-framework.

Core Identifiers: For ease of use, each component of the Core is given a unique identifier. Functions and 

Categories each have a unique alphabetic identifier, as shown in Table 1. Subcategories within each 

Category have a number added to the alphabetic identifier; the unique identifier for each Subcategory is 

included in Table 2.

The Category or Subcategory is identical to the Cybersecurity Framework.

The Function, Category, or Subcategory aligns with the Cybersecurity 

Framework, but the text has been adapted for the Privacy Framework.
NIST Privacy Framework January 16, 2020

19

Table 1: Privacy Framework Function and Category Unique Identifiers

Function 

Unique 

Identifier

Function Category 

Unique 

Identifier

Category

ID-P Identify-P ID.IM-P Inventory and Mapping

ID.BE-P Business Environment

ID.RA-P Risk Assessment

ID.DE-P Data Processing Ecosystem Risk Management

GV-P Govern-P GV.PO-P Governance Policies, Processes, and Procedures

GV.RM-P Risk Management Strategy

GV.AT-P Awareness and Training

GV.MT-P Monitoring and Review

CT-P Control-P CT.PO-P Data Processing Policies, Processes, and Procedures

CT.DM-P Data Processing Management

CT.DP-P Disassociated Processing

CM-P Communicate-P CM.PO-P Communication Policies, Processes, and Procedures

CM.AW-P Data Processing Awareness

PR-P Protect-P PR.PO-P Data Protection Policies, Processes, and Procedures

PR.AC-P Identity Management, Authentication, and Access 

Control

PR.DS-P Data Security

PR.MA-P Maintenance

PR.PT-P Protective Technology

DE Detect DE.AE Anomalies and Events

DE.CM Security Continuous Monitoring

DE.DP Detection Processes

RS Respond RS.RP Response Planning

RS.CO Communications

RS.AN Analysis

RS.MI Mitigation

RS.IM Improvements

RC Recover RC.RP Recovery Planning

RC.IM Improvements

RC.CO Communications
NIST Privacy Framework January 16, 2020

20

Table 2: Privacy Framework Core

Function Category Subcategory

IDENTIFY-P (IDP): Develop the 

organizational 

understanding 

to manage 

privacy risk for 

individuals 

arising from 

data 

processing.

Inventory and Mapping (ID.IM-P): Data 

processing by systems, products, or services 

is understood and informs the management 

of privacy risk.

ID.IM-P1: Systems/products/services that process data are 

inventoried.

ID.IM-P2: Owners or operators (e.g., the organization or third parties 

such as service providers, partners, customers, and developers) and 

their roles with respect to the systems/products/services and 

components (e.g., internal or external) that process data are 

inventoried.

ID.IM-P3: Categories of individuals (e.g., customers, employees or 

prospective employees, consumers) whose data are being processed 

are inventoried.

ID.IM-P4: Data actions of the systems/products/services are 

inventoried.

ID.IM-P5: The purposes for the data actions are inventoried.

ID.IM-P6: Data elements within the data actions are inventoried.

ID.IM-P7: The data processing environment is identified (e.g., 

geographic location, internal, cloud, third parties).

ID.IM-P8: Data processing is mapped, illustrating the data actions and 

associated data elements for systems/products/services, including 

components; roles of the component owners/operators; and 

interactions of individuals or third parties with the 

systems/products/services.

Business Environment (ID.BE-P): The 

organization’s mission, objectives, 

stakeholders, and activities are 

understood and prioritized; this 

information is used to inform privacy 

roles, responsibilities, and risk

management decisions.

ID.BE-P1: The organization’s role(s) in the data processing 

ecosystem are identified and communicated.

ID.BE-P2: Priorities for organizational mission, objectives, and 

activities are established and communicated.

ID.BE-P3: Systems/products/services that support organizational 

priorities are identified and key requirements communicated.
NIST Privacy Framework January 16, 2020

21

Function Category Subcategory

Risk Assessment (ID.RA-P): The 

organization understands the privacy risks

to individuals and how such privacy risks 

may create follow-on impacts on 

organizational operations, including 

mission, functions, other risk management

priorities (e.g., compliance, financial), 

reputation, workforce, and culture.

ID.RA-P1: Contextual factors related to the systems/products/services 

and the data actions are identified (e.g., individuals’ demographics and 

privacy interests or perceptions, data sensitivity and/or types, visibility 

of data processing to individuals and third parties). 

ID.RA-P2: Data analytic inputs and outputs are identified and 

evaluated for bias.

ID.RA-P3: Potential problematic data actions and associated problems 

are identified. 

ID.RA-P4: Problematic data actions, likelihoods, and impacts are 

used to determine and prioritize risk.

ID.RA-P5: Risk responses are identified, prioritized, and 

implemented.

Data Processing Ecosystem Risk 

Management (ID.DE-P): The 

organization’s priorities, constraints, risk

tolerance, and assumptions are 

established and used to support risk 

decisions associated with managing 

privacy risk and third parties within the 

data processing ecosystem. The 

organization has established and 

implemented the processes to identify, 

assess, and manage privacy risks within 

the data processing ecosystem.

ID.DE-P1: Data processing ecosystem risk management policies, 

processes, and procedures are identified, established, assessed, 

managed, and agreed to by organizational stakeholders.

ID.DE-P2: Data processing ecosystem parties (e.g., service 

providers, customers, partners, product manufacturers, application 

developers) are identified, prioritized, and assessed using a privacy 

risk assessment process.

ID.DE-P3: Contracts with data processing ecosystem parties are 

used to implement appropriate measures designed to meet the 

objectives of an organization’s privacy program. 

ID.DE-P4: Interoperability frameworks or similar multi-party 

approaches are used to manage data processing ecosystem privacy 

risks. 

ID.DE-P5: Data processing ecosystem parties are routinely assessed 

using audits, test results, or other forms of evaluations to confirm 

they are meeting their contractual, interoperability framework, or 

other obligations.
NIST Privacy Framework January 16, 2020

22

Function Category Subcategory

GOVERN-P (GV-P):

Develop and 

implement the 

organizational 

governance 

structure to 

enable an ongoing 

understanding of 

the organization’s 

risk management 

priorities that 

are informed by 

privacy risk.

Governance Policies, Processes, and 

Procedures (GV.PO-P): The policies, 

processes, and procedures to manage and 

monitor the organization’s regulatory, 

legal, risk, environmental, and operational 

requirements are understood and inform 

the management of privacy risk.

GV.PO-P1: Organizational privacy values and policies (e.g., 

conditions on data processing such as data uses or retention

periods, individuals’ prerogatives with respect to data processing) 

are established and communicated.

GV.PO-P2: Processes to instill organizational privacy values within 

system/product/service development and operations are established 

and in place.

GV.PO-P3: Roles and responsibilities for the workforce are 

established with respect to privacy. 

GV.PO-P4: Privacy roles and responsibilities are coordinated and 

aligned with third-party stakeholders (e.g., service providers, 

customers, partners).

GV.PO-P5: Legal, regulatory, and contractual requirements 

regarding privacy are understood and managed.

GV.PO-P6: Governance and risk management policies, processes,

and procedures address privacy risks.

Risk Management Strategy (GV.RM-P): 

The organization’s priorities, constraints, 

risk tolerances, and assumptions are 

established and used to support 

operational risk decisions.

GV.RM-P1: Risk management processes are established, managed, 

and agreed to by organizational stakeholders.

GV.RM-P2: Organizational risk tolerance is determined and clearly 

expressed.

GV.RM-P3: The organization’s determination of risk tolerance is 

informed by its role(s) in the data processing ecosystem.

Awareness and Training (GV.AT-P): The 

organization’s workforce and third parties 

engaged in data processing are provided 

privacy awareness education and are 

trained to perform their privacy-related 

duties and responsibilities consistent with 

related policies, processes, procedures, 

and agreements and organizational 

privacy values.

GV.AT-P1: The workforce is informed and trained on its roles and 

responsibilities.

GV.AT-P2: Senior executives understand their roles and 

responsibilities.

GV.AT-P3: Privacy personnel understand their roles and 

responsibilities.

GV.AT-P4: Third parties (e.g., service providers, customers, 

partners) understand their roles and responsibilities.
NIST Privacy Framework January 16, 2020

23

Function Category Subcategory

Monitoring and Review (GV.MT-P): The 

policies, processes, and procedures for 

ongoing review of the organization’s privacy 

posture are understood and inform the 

management of privacy risk.

GV.MT-P1: Privacy risk is re-evaluated on an ongoing basis and as key 

factors, including the organization’s business environment (e.g., 

introduction of new technologies), governance (e.g., legal obligations, 

risk tolerance), data processing, and systems/products/services 

change.

GV.MT-P2: Privacy values, policies, and training are reviewed and any 

updates are communicated. 

GV.MT-P3: Policies, processes, and procedures for assessing

compliance with legal requirements and privacy policies are 

established and in place.

GV.MT-P4: Policies, processes, and procedures for communicating 

progress on managing privacy risks are established and in place.

GV.MT-P5: Policies, processes, and procedures are established and in 

place to receive, analyze, and respond to problematic data actions

disclosed to the organization from internal and external sources (e.g., 

internal discovery, privacy researchers, professional events).

GV.MT-P6: Policies, processes, and procedures incorporate lessons 

learned from problematic data actions.

GV.MT-P7: Policies, processes, and procedures for receiving, tracking, 

and responding to complaints, concerns, and questions from 

individuals about organizational privacy practices are established and 

in place.

CONTROL-P (CTP): Develop and 

implement 

appropriate 

activities to enable 

organizations or 

individuals to 

manage data with 

sufficient 

granularity to 

Data Processing Policies, Processes, and 

Procedures (CT.PO-P): Policies, processes, 

and procedures are maintained and used to 

manage data processing (e.g., purpose, 

scope, roles and responsibilities in the data 

processing ecosystem, and management 

commitment) consistent with the 

organization’s risk strategy to protect 

individuals’ privacy.

CT.PO-P1: Policies, processes, and procedures for authorizing data 

processing (e.g., organizational decisions, individual consent), revoking 

authorizations, and maintaining authorizations are established and in 

place.

CT.PO-P2: Policies, processes, and procedures for enabling data

review, transfer, sharing or disclosure, alteration, and deletion are 

established and in place (e.g., to maintain data quality, manage data 

retention).

CT.PO-P3: Policies, processes, and procedures for enabling individuals’ 

data processing preferences and requests are established and in place.
NIST Privacy Framework January 16, 2020

24

Function Category Subcategory

manage privacy 

risks.

CT.PO-P4: A data life cycle to manage data is aligned and 

implemented with the system development life cycle to manage 

systems.

Data Processing Management (CT.DM-P):

Data are managed consistent with the 

organization’s risk strategy to protect 

individuals’ privacy, increase manageability, 

and enable the implementation of privacy 

principles (e.g., individual participation, data 

quality, data minimization). 

CT.DM-P1: Data elements can be accessed for review.

CT.DM-P2: Data elements can be accessed for transmission or 

disclosure.

CT.DM-P3: Data elements can be accessed for alteration.

CT.DM-P4: Data elements can be accessed for deletion.

CT.DM-P5: Data are destroyed according to policy.

CT.DM-P6: Data are transmitted using standardized formats.

CT.DM-P7: Mechanisms for transmitting processing permissions and 

related data values with data elements are established and in place.

CT.DM-P8: Audit/log records are determined, documented, 

implemented, and reviewed in accordance with policy and 

incorporating the principle of data minimization.

CT.DM-P9: Technical measures implemented to manage data 

processing are tested and assessed.

CT.DM-P10: Stakeholder privacy preferences are included in 

algorithmic design objectives and outputs are evaluated against 

these preferences.

Disassociated Processing (CT.DP-P): Data 

processing solutions increase disassociability

consistent with the organization’s risk

strategy to protect individuals’ privacy and 

enable implementation of privacy principles 

(e.g., data minimization).

CT.DP-P1: Data are processed to limit observability and linkability (e.g., 

data actions take place on local devices, privacy-preserving 

cryptography).

CT.DP-P2: Data are processed to limit the identification of individuals 

(e.g., de-identification privacy techniques, tokenization).

CT.DP-P3: Data are processed to limit the formulation of inferences 

about individuals’ behavior or activities (e.g., data processing is 

decentralized, distributed architectures).

CT.DP-P4: System or device configurations permit selective collection 

or disclosure of data elements.

CT.DP-P5: Attribute references are substituted for attribute values.
NIST Privacy Framework January 16, 2020

25

Function Category Subcategory

COMMUNICATE-P 

(CM-P): Develop 

and implement 

appropriate 

activities to enable 

organizations and 

individuals to have 

a reliable 

understanding and 

engage in a 

dialogue about 

how data are 

processed and 

associated privacy 

risks.

Communication Policies, Processes, and 

Procedures (CM.PO-P): Policies, processes, 

and procedures are maintained and used to 

increase transparency of the organization’s 

data processing practices (e.g., purpose, 

scope, roles and responsibilities in the data 

processing ecosystem, and management 

commitment) and associated privacy risks.

CM.PO-P1: Transparency policies, processes, and procedures for

communicating data processing purposes, practices, and associated

privacy risks are established and in place.

CM.PO-P2: Roles and responsibilities (e.g., public relations) for

communicating data processing purposes, practices, and associated

privacy risks are established.

Data Processing Awareness (CM.AW-P):

Individuals and organizations have reliable 

knowledge about data processing practices 

and associated privacy risks, and effective 

mechanisms are used and maintained to 

increase predictability consistent with the 

organization’s risk strategy to protect 

individuals’ privacy. 

CM.AW-P1: Mechanisms (e.g., notices, internal or public reports) for

communicating data processing purposes, practices, associated privacy

risks, and options for enabling individuals’ data processing preferences

and requests are established and in place.

CM.AW-P2: Mechanisms for obtaining feedback from individuals (e.g.,

surveys or focus groups) about data processing and associated privacy

risks are established and in place.

CM.AW-P3: System/product/service design enables data processing

visibility.

CM.AW-P4: Records of data disclosures and sharing are maintained

and can be accessed for review or transmission/disclosure.

CM.AW-P5: Data corrections or deletions can be communicated to

individuals or organizations (e.g., data sources) in the data processing

ecosystem.

CM.AW-P6: Data provenance and lineage are maintained and can be

accessed for review or transmission/disclosure.

CM.AW-P7: Impacted individuals and organizations are notified about

a privacy breach or event.

CM.AW-P8: Individuals are provided with mitigation mechanisms (e.g.,

credit monitoring, consent withdrawal, data alteration or deletion) to

address impacts of problematic data actions.

PROTECT-P 

(PR-P): Develop 

and implement 

Data Protection Policies, Processes, and 

Procedures (PR.PO-P): Security and 

privacy policies (e.g., purpose, scope, roles

PR.PO-P1: A baseline configuration of information technology is 

created and maintained incorporating security principles (e.g.,

concept of least functionality).
NIST Privacy Framework January 16, 2020

26

Function Category Subcategory

appropriate 

data processing 

safeguards.

and responsibilities in the data processing 

ecosystem, and management 

commitment), processes, and procedures 

are maintained and used to manage the 

protection of data.

PR.PO-P2: Configuration change control processes are established 

and in place.

PR.PO-P3: Backups of information are conducted, maintained, and 

tested.

PR.PO-P4: Policy and regulations regarding the physical operating 

environment for organizational assets are met.

PR.PO-P5: Protection processes are improved.

PR.PO-P6: Effectiveness of protection technologies is shared.

PR.PO-P7: Response plans (Incident Response and Business 

Continuity) and recovery plans (Incident Recovery and Disaster 

Recovery) are established, in place, and managed.

PR.PO-P8: Response and recovery plans are tested.

PR.PO-P9: Privacy procedures are included in human resources 

practices (e.g., deprovisioning, personnel screening).

PR.PO-P10: A vulnerability management plan is developed and 

implemented.

Identity Management, Authentication, 

and Access Control (PR.AC-P): Access to 

data and devices is limited to authorized 

individuals, processes, and devices, and is 

managed consistent with the assessed risk

of unauthorized access.

PR.AC-P1: Identities and credentials are issued, managed, verified, 

revoked, and audited for authorized individuals, processes, and 

devices.

PR.AC-P2: Physical access to data and devices is managed.

PR.AC-P3: Remote access is managed.

PR.AC-P4: Access permissions and authorizations are managed, 

incorporating the principles of least privilege and separation of 

duties.

PR.AC-P5: Network integrity is protected (e.g., network 

segregation, network segmentation).

PR.AC-P6: Individuals and devices are proofed and bound to 

credentials, and authenticated commensurate with the risk of the 

transaction (e.g., individuals’ security and privacy risks and other 

organizational risks).

Data Security (PR.DS-P): Data are 

managed consistent with the 

PR.DS-P1: Data-at-rest are protected.

PR.DS-P2: Data-in-transit are protected.
NIST Privacy Framework January 16, 2020

27

Function Category Subcategory

organization’s risk strategy to protect 

individuals’ privacy and maintain data 

confidentiality, integrity, and availability.

PR.DS-P3: Systems/products/services and associated data are 

formally managed throughout removal, transfers, and disposition.

PR.DS-P4: Adequate capacity to ensure availability is maintained.

PR.DS-P5: Protections against data leaks are implemented.

PR.DS-P6: Integrity checking mechanisms are used to verify 

software, firmware, and information integrity.

PR.DS-P7: The development and testing environment(s) are 

separate from the production environment.

PR.DS-P8: Integrity checking mechanisms are used to verify 

hardware integrity.

Maintenance (PR.MA-P): System 

maintenance and repairs are performed 

consistent with policies, processes, and 

procedures.

PR.MA-P1: Maintenance and repair of organizational assets are 

performed and logged, with approved and controlled tools.

PR.MA-P2: Remote maintenance of organizational assets is 

approved, logged, and performed in a manner that prevents 

unauthorized access.

Protective Technology (PR.PT-P):

Technical security solutions are managed 

to ensure the security and resilience of 

systems/products/services and associated 

data, consistent with related policies, 

processes, procedures, and agreements.

PR.PT-P1: Removable media is protected and its use restricted 

according to policy.

PR.PT-P2: The principle of least functionality is incorporated by 

configuring systems to provide only essential capabilities.

PR.PT-P3: Communications and control networks are protected.

PR.PT-P4: Mechanisms (e.g., failsafe, load balancing, hot swap) are 

implemented to achieve resilience requirements in normal and 

adverse situations.
NIST Privacy Framework January 16, 2020

28

Appendix B: Glossary

This appendix defines selected terms used for the purposes of this publication.

Attribute Reference

(NIST SP 800-63-3 [8]) 

A statement asserting a property of a subscriber without necessarily 

containing identity information, independent of format. For example, for 

the attribute “birthday,” a reference could be “older than 18” or “born in 

December.”

Attribute Value

(NIST SP 800-63-3 [8])

A complete statement asserting a property of a subscriber, independent 

of format. For example, for the attribute “birthday,” a value could be 

“12/1/1980” or “December 1, 1980.”

Availability 

(44 U.S.C. [13])

Ensuring timely and reliable access to and use of information.

Category The subdivision of a Function into groups of privacy outcomes closely tied 

to programmatic needs and particular activities.

Communicate-P

(Function)

Develop and implement appropriate activities to enable organizations 

and individuals to have a reliable understanding and engage in a dialogue 

about how data are processed and associated privacy risks.

Confidentiality

(44 U.S.C. [13])

Preserving authorized restrictions on information access and disclosure, 

including means for protecting personal privacy and proprietary 

information.

Control-P (Function) Develop and implement appropriate activities to enable organizations or 

individuals to manage data with sufficient granularity to manage privacy 

risks.

Core A set of privacy protection activities and outcomes. The Framework Core 

comprises three elements: Functions, Categories, and Subcategories.

Cybersecurity Incident

(Framework for 

Improving Critical 

Infrastructure 

Cybersecurity [1])

A cybersecurity event that has been determined to have an impact on the 

organization prompting the need for response and recovery.

(OMB 17-12 [9]) An occurrence that (1) actually or imminently jeopardizes, without lawful 

authority, the integrity, confidentiality, or availability of information or an 

information system; or (2) constitutes a violation or imminent threat of 

violation of law, security policies, security procedures, or acceptable use 

policies.

Data A representation of information, including digital and non-digital formats.
NIST Privacy Framework January 16, 2020

29

Data Action (Adapted 

from NIST IR 8062 [5])

A system/product/service data life cycle operation, including, but not 

limited to collection, retention, logging, generation, transformation, use, 

disclosure, sharing, transmission, and disposal.

Data Element The smallest named item of data that conveys meaningful information.

Data Processing

(Adapted from NIST IR 

8062 [5])

The collective set of data actions (i.e., the complete data life cycle, 

including, but not limited to collection, retention, logging, generation, 

transformation, use, disclosure, sharing, transmission, and disposal).

Data Processing 

Ecosystem

The complex and interconnected relationships among entities involved in 

creating or deploying systems, products, or services or any components 

that process data.

Disassociability (Adapted 

from NIST IR 8062 [5])

Enabling the processing of data or events without association to 

individuals or devices beyond the operational requirements of the 

system.

Function A component of the Core that provides the highest level of structure for 

organizing basic privacy activities into Categories and Subcategories.

Govern-P (Function) Develop and implement the organizational governance structure to 

enable an ongoing understanding of the organization’s risk management 

priorities that are informed by privacy risk.

Identify-P (Function) Develop the organizational understanding to manage privacy risk for 

individuals arising from data processing.

Implementation Tier Provides a point of reference on how an organization views privacy risk 

and whether it has sufficient processes and resources in place to manage 

that risk.

Individual A single person or a group of persons, including at a societal level.

Integrity

(44 U.S.C. [13])

Guarding against improper information modification or destruction, and 

includes ensuring information non-repudiation and authenticity.

Lineage The history of processing of a data element, which may include point-topoint data flows and the data actions performed upon the data element. 

Manageability (Adapted 

from NIST IR 8062 [5])

Providing the capability for granular administration of data, including 

alteration, deletion, and selective disclosure.

Metadata (Adapted from 

NIST SP 800-53 [10])

Information describing the characteristics of data.

This may include, for example, structural metadata describing data 

structures (i.e., data format, syntax, semantics) and descriptive metadata 

describing data contents.

Predictability (Adapted 

from NIST IR 8062 [5])

Enabling reliable assumptions by individuals, owners, and operators 

about data and their processing by a system, product, or service.
NIST Privacy Framework January 16, 2020

30

Privacy Breach (Adapted

from OMB M-17-12 [9])

The loss of control, compromise, unauthorized disclosure, unauthorized 

acquisition, or any similar occurrence where (1) a person other than an 

authorized user accesses or potentially accesses data or (2) an authorized 

user accesses data for an other than authorized purpose. 

Privacy Control (Adapted 

from NIST SP 800-37 [7])

The administrative, technical, and physical safeguards employed within 

an organization to satisfy privacy requirements.

Privacy Event The occurrence or potential occurrence of problematic data actions.

Privacy Requirement A specification for system/product/service functionality to meet 

stakeholders’ desired privacy outcomes.

Privacy Risk The likelihood that individuals will experience problems resulting from 

data processing, and the impact should they occur.

Privacy Risk Assessment A privacy risk management sub-process for identifying and evaluating 

specific privacy risks.

Privacy Risk 

Management

A cross-organizational set of processes for identifying, assessing, and 

responding to privacy risks.

Problematic Data Action

(Adapted from NIST IR 

8062 [5])

A data action that could cause an adverse effect for individuals.

Processing See Data Processing.

Profile A selection of specific Functions, Categories, and Subcategories from the 

Core that an organization has prioritized to help it manage privacy risk.

Protect-P (Function) Develop and implement appropriate data processing safeguards.

Provenance (Adapted

from NIST IR 8112 [11])

Metadata pertaining to the origination or source of specified data.

Risk

(NIST SP 800-30 [12])

A measure of the extent to which an entity is threatened by a potential 

circumstance or event, and typically a function of: (i) the adverse impacts 

that would arise if the circumstance or event occurs; and (ii) the 

likelihood of occurrence.

Risk Management The process of identifying, assessing, and responding to risk.

Risk Tolerance

(NIST SP 800-39 [6])

The level of risk or degree of uncertainty that is acceptable to 

organizations.

Subcategory The further divisions of a Category into specific outcomes of technical 

and/or management activities.
NIST Privacy Framework January 16, 2020

31

Appendix C: Acronyms

This appendix defines selected acronyms used in the publication.

IEC International Electrotechnical Commission

IR Interagency or Internal Report

ISO International Organization for Standardization

IT Information Technology

NIST National Institute of Standards and Technology

OASIS Organization for the Advancement of Structured Information Standards

OECD Organisation for Economic Co-operation and Development

OMB Office of Management and Budget

PMRM Privacy Management Reference Model and Methodology

PRAM Privacy Risk Assessment Methodology

RFC Request for Comment

RFI Request for Information

SDLC System Development Life Cycle

SP Special Publication
NIST Privacy Framework January 16, 2020

32

Appendix D: Privacy Risk Management Practices 

Section 1.2 introduces a number of considerations around privacy risk management, including the 

relationship between cybersecurity and privacy risk and the role of privacy risk assessment. This 

appendix considers some of the key practices that contribute to successful privacy risk management, 

including organizing preparatory resources, determining privacy capabilities, defining privacy 

requirements, conducting privacy risk assessments, creating privacy requirements traceability, and 

monitoring for changing privacy risks. Category and Subcategory references are included to facilitate use 

of the Core to support these practices; these references appear in parentheticals. 

Organizing Preparatory Resources

The appropriate resources facilitate informed decision-making about privacy risks at all levels of an 

organization. As a practical matter, the responsibility for the development of various resources may 

belong to different components of an organization. Therefore, a component of an organization 

depending on certain resources may find that they either do not exist, or may not sufficiently address 

privacy. In these circumstances, the dependent component can consider the purpose of the resource 

and either seek the information through other sources or make the best decision it can with the 

available information. In short, good resources are helpful, but any deficiencies should not prevent

organizational components from making the best risk decisions they can within their capabilities. 

The following resources, while not exhaustive, build a foundation for better decision-making.

• Risk management role assignments (GV.PO-P3, GV.PO-P4)

Establishing and enabling cross-organizational understanding of who is accountable and who 

has responsibility for privacy risk management as well as other risk management tasks in an

organization supports better coordination and accountability for decision-making. In addition, a

broad range of perspectives can improve the process of identifying, assessing, and responding to 

privacy risks. A diverse and cross-functional team can help to identify a more comprehensive 

range of risks to individuals’ privacy, and to select a wider set of mitigations. Determining which 

roles to include in the risk management discussions depends on organizational context and 

makeup, although collaboration between an organization’s privacy and cybersecurity programs 

will be important. If one individual is being assigned to multiple roles, managing potential 

conflicts of interest should be considered.

• Enterprise risk management strategy (GV.RM-P)

An organization’s enterprise risk management strategy helps to align an organization’s mission 

and values with organizational risk tolerance, assumptions, constraints, and priorities.

Limitations on resources to achieve mission or business objectives and to manage a broad 

portfolio of risks will likely require trade-offs. Enabling personnel involved in the privacy risk 

management process to better understand an organization’s risk tolerance should help to guide 

decisions about how to allocate resources and improve decisions around risk response. 

• Key stakeholders (GV.PO-P4, ID.DE-P)

Privacy stakeholders are those who have an interest or concern in the privacy outcomes of the 

system, product, or service. For example, legal concerns likely focus on whether the system, 

product, or service is operating in a way that would cause an organization to be out of 

compliance with privacy laws or regulations or its business agreements. Business owners that 

want to maximize usage may be concerned about loss of trust in the system, product, or service 
NIST Privacy Framework January 16, 2020

33

due to poor privacy. Individuals whose data are being processed or who are interacting with the 

system, product, or service will be interested in not experiencing problems or adverse 

consequences. Understanding the stakeholders and the types of privacy outcomes they are 

interested in will facilitate system/product/service design that appropriately addresses 

stakeholders’ needs.

• Organizational-level privacy requirements (GV.PO-P)

Organizational-level privacy requirements are a means of expressing the legal obligations, 

privacy values, and policies to which an organization intends to adhere. Understanding these 

requirements is key to ensuring that the system/product/service design complies with its 

obligations. Organizational-level privacy requirements may be derived from a variety of sources, 

including:

o Legal environment (e.g., laws, regulations, contracts);

o Organizational policies or cultural values;

o Relevant standards; and

o Privacy principles.

• System/product/service design artifacts (ID.BE-P3)

Design artifacts may take many forms such as system design architectures or data flow 

diagrams. These artifacts help an organization determine how its systems, products, and

services will operate. Therefore, they can help privacy programs understand how systems, 

products, and services need to function so that controls or measures that help to mitigate 

privacy risk can be selected and implemented in ways that maintain functionality while

protecting privacy. 

• Data maps (ID.IM-P) 

Data maps illustrate data processing and individuals’ interactions with systems, products, and

services. A data map shows the data processing environment and includes the components 

through which data are being processed or with which individuals are interacting, the owners or 

operators of the components, and discrete data actions and the specific data elements being 

processed. Data maps can be illustrated in different ways, and the level of detail may vary based 

on an organization’s needs. A data map can be overlaid on existing system/product/service 

design artifacts for convenience and ease of communication between organizational 

components. As discussed below, a data map is an important artifact in privacy risk assessment. 

Determining Privacy Capabilities

Privacy capabilities can be used to describe the system, product, or service property or feature that 

achieves the desired privacy outcome (e.g., “the service enables data minimization”). The security 

objectives confidentiality, integrity, and availability along with security requirements are used to inform 

the security capabilities for a system, product, or service. As set forth in Table 3, an additional set of 

privacy engineering objectives can support the determination of privacy capabilities. An organization 

may also use the privacy engineering objectives as a high-level prioritization tool. Systems, products, or 

services that are low in predictability, manageability, or disassociability may be a signal of increased 

privacy risk, and therefore merit a more comprehensive privacy risk assessment. 
NIST Privacy Framework January 16, 2020

34

In determining privacy capabilities, an organization may consider which of the privacy engineering and 

security objectives are most important with respect to its mission or business needs, risk tolerance, and 

organizational-level privacy requirements (see Organizing Preparatory Resources above). Not all of the 

objectives may be equally important, or trade-offs may be necessary among them. Although the privacy 

capabilities inform the privacy risk assessment by supporting risk prioritization decisions, the privacy 

capabilities may also be informed by the risk assessment and adjusted to support the management of 

specific privacy risks or address changes in the environment, including design changes to the system, 

product, or service.

Table 3: Privacy Engineering and Security Objectives18

Objective Definition

Principal Related 

Functions from the 

Privacy Framework Core

Privacy Engineering 

Objectives

Predictability Enabling reliable assumptions by individuals, 

owners, and operators about data and their

processing by a system

Identify-P, Govern-P, 

Control-P, CommunicateP, Protect-P

Manageability Providing the capability for granular 

administration of data, including collection, 

alteration, deletion, and selective disclosure

Identify-P, Govern-P, 

Control-P

Disassociability Enabling the processing of data or events 

without association to individuals or devices 

beyond the operational requirements of the 

system

Identify-P, Govern-P, 

Control-P

Security Objectives

Confidentiality Preserving authorized restrictions on 

information access and disclosure, including 

means for protecting personal privacy and 

proprietary information

Identify-P, Govern-P, 

Protect-P

Integrity Guarding against improper information 

modification or destruction; includes ensuring 

information non-repudiation and authenticity

Identify-P, Govern-P, 

Protect-P

Availability Ensuring timely and reliable access to and use 

of information

Identify-P, Govern-P, 

Protect-P

Defining Privacy Requirements

Privacy requirements specify the way a system, product, or service needs to function to meet 

stakeholders’ desired privacy outcomes (e.g., “the application is configured to allow users to select 

specific data elements”). To define privacy requirements, consider organizational-level privacy 

requirements (see Organizing Preparatory Resources above) and the outputs of a privacy risk 

assessment. This process helps an organization to answer two questions: 1) What can a system, product, 

or service do with data processing and interactions with individuals? 2) What should it do? Then an 

organization can allocate resources to design a system, product, or service in a way that achieves the 

defined requirements. Ultimately, defining privacy requirements can lead to the development of 

 

18 The privacy engineering objectives are adapted from NIST IR 8062 [5]. The security objectives are from NIST SP 

800-37, Rev. 2 [7].
NIST Privacy Framework January 16, 2020

35

systems, products, and services that are more mindful of individuals’ privacy, and are based on informed 

risk decisions.

Conducting Privacy Risk Assessments

Conducting a privacy risk assessment helps an organization to identify privacy risks engendered by the 

system, product, or service and prioritize them to be able to make informed decisions about how to 

respond to the risks (ID.RA-P, GV.RM-P). Methodologies for conducting privacy risk assessments may 

vary, but organizations should consider the following characteristics:19

• Risk model (ID.RA-P, GV.MT-P1)

Risk models define the risk factors to be assessed and the relationships among those factors.20 If 

an organization is not using a pre-defined risk model, an organization should clearly define 

which risk factors it will be assessing and the relationships among these factors. Although 

cybersecurity has a widely used risk model 

based on the risk factors of threats, 

vulnerabilities, likelihood, and impact, 

there is not one commonly accepted 

privacy risk model. NIST has developed a 

privacy risk model to calculate risk based on the likelihood of a problematic data action 

multiplied by the impact of a problematic data action; each of the three risk factors are

explained below.

o A problematic data action is any action a system takes to process data that could result in a 

problem for individuals. Organizations consider the type of problems that are relevant to 

the population of individuals. Problems can take any form and may consider the experience 

of individuals.21

o Likelihood is defined as a contextual analysis that a data action is likely to create a problem 

for a representative set of individuals. Context can include organizational factors (e.g., 

geographic location, the public perception about participating organizations with respect to 

privacy), system factors (e.g., the nature and history of individuals’ interactions with the 

system, visibility of data processing to individuals and third parties), or individual factors 

(e.g., individuals’ demographics, privacy interests or perceptions, data sensitivity).22 A data 

map can help with this contextual analysis (see Organizing Preparatory Resources).

o Impact is an analysis of the costs should the problem occur. As noted in section 1.2, 

organizations do not experience these problems directly. Moreover, individuals’ experiences 

may be subjective. Thus, impact may be difficult to assess accurately. Organizations should 

 

19 NIST has developed a Privacy Risk Assessment Methodology (PRAM) that can help organizations identify, 

assess, and respond to privacy risks. It is comprised of a set of worksheets available at [3].

20 See NIST SP 800-30, Rev. 1, Guide for Conducting Risk Assessments [12] at p. 8.

21 As part of its PRAM, NIST has created an illustrative catalog of problematic data actions and problems for 

consideration [3]. Other organizations may have created additional problem sets, or may refer to them as 

adverse consequences or harms.

22 See NIST PRAM for more information about contextual factors. Id. at Worksheet 2.

Privacy Risk Factors:

Problematic Data Action | Likelihood | Impact
NIST Privacy Framework January 16, 2020

36

consider the best means of internalizing impact to individuals in order to appropriately 

prioritize and respond to privacy risks.23

• Assessment approach

The assessment approach is the mechanism by which identified risks are prioritized. Assessment 

approaches can be categorized as quantitative, semi-quantitative, or qualitative.

24 25

• Prioritizing risks (ID.RA-P4)

Given the applicable limits of an organization’s resources, organizations prioritize the risks to 

facilitate communication about how to respond.

26

• Responding to risks (ID.RA-P5)

As described in section 1.2.2, response approaches include mitigation, transfer/sharing, 

avoidance, or acceptance.27

Creating Privacy Requirements Traceability

Once an organization has determined which risks to mitigate, it can refine the privacy requirements and 

then select and implement controls (i.e., technical, physical, and/or policy safeguards) to meet the 

requirements.28 An organization may use a variety of sources to select controls, such as NIST SP 800-53, 

Security and Privacy Controls for Information Systems and Organizations.29 After implementation, an 

organization iteratively assesses the controls for their effectiveness in meeting the privacy requirements 

and managing privacy risk. In this way, an organization creates traceability between the controls and the 

privacy requirements, and demonstrates accountability between its systems, products, and services and 

its organizational privacy goals.

Monitoring Change

Privacy risk management is not a static process. An organization monitors how changes in its business 

environment—including new laws and regulations and emerging technologies—and corresponding 

changes to its systems, products, and services may be affecting privacy risk, and iteratively uses the 

practices in this appendix to adjust accordingly. (GV.MT-P1)

 

23 The NIST PRAM uses organizational costs such as non-compliance costs, direct business costs, reputational 

costs, and internal culture costs as drivers for considering how to assess individual impact. Id. at Worksheet 3, 

Impact Tab.

24 See NIST SP 800-30, Rev. 1, Guide for Conducting Risk Assessments at [12] p. 14.

25 The NIST PRAM uses a semi-quantitative approach based on a scale of 1-10.

26 The NIST PRAM provides various prioritization representations, including a heat map. See [3] Worksheet 3.

27 The NIST PRAM provides a process for responding to prioritized privacy risks. Id. at Worksheet 4.

28 See NIST SP 800-37, Rev. 2 [7].

29 See NIST SP 800-53 as updated [10].
NIST Privacy Framework January 16, 2020

37

Appendix E: Implementation Tiers Definitions

The four Tiers summarized below are each defined with four elements:

Tier 1: Partial

• Privacy Risk Management Process – Organizational privacy risk management practices are not 

formalized, and risk is managed in an ad hoc and sometimes reactive manner. Prioritization of 

privacy activities may not be directly informed by organizational risk management priorities, 

privacy risk assessments, or mission or business objectives.

• Integrated Privacy Risk Management Program – There is limited awareness of privacy risk at 

the organizational level. The organization implements privacy risk management on an irregular, 

case-by-case basis due to varied experience or information gained from outside sources. The 

organization may not have processes that enable the sharing of information about data 

processing and resulting privacy risks within the organization.

• Data Processing Ecosystem Relationships – There is limited understanding of an organization’s 

role(s) in the larger ecosystem with respect to other entities (e.g., buyers, suppliers, service 

providers, business associates, partners). The organization does not have processes for 

identifying how privacy risks may proliferate throughout the ecosystem or for communicating 

privacy risks or requirements to other entities in the ecosystem.

• Workforce – Some personnel may have a limited understanding of privacy risks or privacy risk 

management processes, but have no specific privacy responsibilities. If available, privacy 

training is ad hoc and the content is not kept current with best practices.

Tier 2: Risk Informed

• Privacy Risk Management Process – Risk management practices are approved by management 

but may not be established as organization-wide policy. Prioritization of privacy activities is 

directly informed by organizational risk management priorities, privacy risk assessments, or 

mission or business objectives.

• Integrated Privacy Risk Management Program – There is an awareness of privacy risk at the 

organizational level, but an organization-wide approach to managing privacy risk has not been 

established. Information about data processing and resulting privacy risks is shared within the 

organization on an informal basis. Consideration of privacy in organizational objectives and 

programs may occur at some but not all levels of the organization. Privacy risk assessment 

occurs, but is not typically repeatable or reoccurring.

• Data Processing Ecosystem Relationships – There is some understanding of an organization’s 

role(s) in the larger ecosystem with respect to other entities (e.g., buyers, suppliers, service 

providers, business associates, partners). The organization is aware of the privacy ecosystem

risks associated with the products and services it provides and uses, but does not act 

consistently or formally upon those risks.

• Workforce – There are personnel with specific privacy responsibilities, but they may have nonprivacy responsibilities as well. Privacy training is conducted regularly for privacy personnel, 

although there is no consistent process for updates on best practices.
NIST Privacy Framework January 16, 2020

38

Tier 3: Repeatable

• Privacy Risk Management Process – The organization’s risk management practices are formally 

approved and expressed as policy. Organizational privacy practices are regularly updated based 

on the application of risk management processes to changes in mission or business objectives

and a changing risk, policy, and technology landscape.

• Integrated Privacy Risk Management Program – There is an organization-wide approach to 

manage privacy risk. Risk-informed policies, processes, and procedures are defined, 

implemented as intended, and reviewed. Consistent methods are in place to respond effectively 

to changes in risk. The organization consistently and accurately monitors privacy risk. Senior 

privacy and non-privacy executives communicate regularly regarding privacy risk. Senior 

executives ensure consideration of privacy through all lines of operation in the organization.

• Data Processing Ecosystem Relationships – The organization understands its role(s), 

dependencies, and dependents in the larger ecosystem and may contribute to the community’s 

broader understanding of risks. The organization is aware of the privacy ecosystem risks 

associated with the products and services it provides and it uses. Additionally, it usually acts 

formally upon those risks, including mechanisms such as written agreements to communicate 

privacy requirements, governance structures, and policy implementation and monitoring.

• Workforce – Dedicated privacy personnel possess the knowledge and skills to perform their 

appointed roles and responsibilities. There is regular, up-to-date privacy training for all 

personnel.

Tier 4: Adaptive

• Privacy Risk Management Process – The organization adapts its privacy practices based on 

lessons learned from privacy events, and identification of new privacy risks. Through a process 

of continuous improvement incorporating advanced privacy technologies and practices, the 

organization actively adapts to a changing policy and technology landscape and responds in a 

timely and effective manner to evolving privacy risks.

• Integrated Privacy Risk Management Program – There is an organization-wide approach to 

managing privacy risk that uses risk-informed policies, processes, and procedures to address 

problematic data actions. The relationship between privacy risk and organizational objectives is 

clearly understood and considered when making decisions. Senior executives monitor privacy 

risk in the same context as cybersecurity risk, financial risk, and other organizational risks. The 

organizational budget is based on an understanding of the current and predicted risk 

environment and risk tolerance. Business units implement executive vision and analyze systemlevel risks in the context of the organizational risk tolerances. Privacy risk management is part of 

the organizational culture and evolves from lessons learned and continuous awareness of data 

processing and resulting privacy risks. The organization can quickly and efficiently account for 

changes to business/mission objectives in how risk is approached and communicated.

• Data Processing Ecosystem Relationships – The organization understands its role(s), 

dependencies, and dependents in the larger ecosystem and contributes to the community’s 

broader understanding of risks. The organization uses real-time or near-real-time information to 

understand and consistently act upon privacy ecosystem risks associated with the products and 

services it provides and it uses. Additionally, it communicates proactively, using formal (e.g.,

agreements) and informal mechanisms to develop and maintain strong ecosystem relationships.
NIST Privacy Framework January 16, 2020

39

• Workforce – The organization has specialized privacy skillsets throughout the organizational 

structure; personnel with diverse perspectives contribute to the management of privacy risks. 

There is regular, up-to-date, specialized privacy training for all personnel. Personnel at all levels 

understand the organizational privacy values and their role in maintaining them.