Webinar Series

The Intersection of the Privacy and Cybersecurity Workforce

February 19, 2020
NICE Framework Knowledge Descriptions

2

K0004: Knowledge of cybersecurity and privacy 

principles.
Privacy Principles

• Organization for Economic Cooperation and 

Development (OECD) 

http://www.oecd.org/corporate/mne/1922428.pdf

• Office of Management and Budget Circular A-130 

(2016) 

https://www.whitehouse.gov/sites/whitehouse.gov

/files/omb/circulars/A130/a130revised.pdf

3
Privacy Engineering Objectives

Predictability

Enabling reliable assumptions by individuals, owners, and 

operators about data and their processing by a system, 

product, or service

Manageability

Providing the capability for granular administration of data, 

including alteration, deletion, and selective disclosure

Disassociability

Enabling the processing of data or events without association to 

individuals or devices beyond the operational requirements of 

the system

4
Relationship Between Cybersecurity and 

Privacy Risk

Data: A representation of information, 

including digital and non-digital formats

Privacy Event: The occurrence or 

potential occurrence of problematic data 

actions

Data Processing: The collective set of 

data actions (i.e., the complete data life 

cycle, including, but not limited to 

collection, retention, logging, generation, 

transformation, use, disclosure, sharing, 

transmission, and disposal)

Privacy Risk: The likelihood that 

individuals will experience problems 

resulting from data processing, and the 

impact should they occur

Cybersecurity 

Risks 

Privacy 

Risks

associated with 

cybersecurity 

incidents arising from 

loss of confidentiality, 

integrity, or 

availability

associated with 

privacy events 

arising from data 

processing

cyber

securityrelated 

privacy 

events

5
Privacy Framework Structure

The Core provides an increasingly granular set of activities 

and outcomes that enable an organizational dialogue 

about managing privacy risk

Profiles are a selection of specific 

Functions, Categories, and Subcategories 

from the Core that the organization has 

prioritized to help it manage privacy risk CURRENT

TARGET

Implementation Tiers help an organization communicate 

about whether it has sufficient processes and resources in 

place to manage privacy risk and achieve its Target Profile

6
Privacy Framework Core

FUNCTIONS CATEGORIES SUBCATEGORIES

Identify-P

Govern-P

Protect-P

Control-P

Communicate-P

7
Control-P Example

Data Processing 

Management (CT.DM-P):

Data are managed 

consistent with the 

organization’s risk strategy 

to protect individuals’ 

privacy, increase 

manageability, and 

enable the 

implementation of privacy 

principles (e.g., individual 

participation, data quality, 

data minimization).

CT.DM-P3: Data elements 

can be accessed for 

alteration.

CT.DM-P4: Data elements 

can be accessed for 

deletion.

Control-P

FUNCTIONS CATEGORIES SUBCATEGORIES

CT.DM-P1: Data elements 

can be accessed for review.

CT.DM-P2: Data elements 

can be accessed for 

transmission or disclosure.

8
Cybersecurity Framework Alignment

Cybersecurity 

Risks 

Privacy 

Risks

IDENTIFY-P

GOVERN-P

CONTROL-P

COMMUNICATE-P

IDENTIFY

PROTECT

DETECT

RESPOND

RECOVER

Cybersecurityrelated privacy 

events

PROTECT-P

DETECT

RESPOND

RECOVER

9
Roadmap

• Privacy Risk Assessment

• Mechanisms to Provide Confidence

• Emerging Technologies

• De-Identification Techniques and Re-identification Risks

• Inventory and Mapping

• Technical Standards

• Privacy Workforce

• International and Regulatory Aspects, Impacts and Alignment

10
Privacy Framework Resources

Website

https://www.nist.gov/privacyframework

Mailing List 

List.nist.gov/privacyframework

Contact Us 

PrivacyFramework@nist.gov 

@NISTcyber #PrivacyFramework

11
Q & A 

12
The Mission of the 

IAPP is to Define, 

Promote and 

Improve the Privacy 

Profession Globally. 

13
Globally, the laws are becoming more stringent and 

enforcement is ramping up.

$3T $5T

Increasing Cost of Breaches

2019 2024

- Juniper research, 8/19

14
Privacy by Design

Laws require compliance 

with the principles of 

Privacy by Design. • changes the way to 

plan, design, build, test 

and maintain 

applications

• Affects the way we vet 

and integrate Third 

Party Software

15 
What are the 

overall 

responsibilities 

of privacy 

teams?

94%

88%

86%

86%

85%

85%

84%

83%

81%

79%

77%

74%

Privacy policies, procedures, governance

Companywide awareness and training

Addressing issues with products and

services

Following legislative developments

Performing PIAs

Incident response

Privacy-related communications

Compliance with the GDPR

Design and implementation of privacy

controls

Addressing privacy in product development

Privacy-related investigations

Data inventory and mapping

16
What are the 

overall 

responsibilities 

of privacy 

teams?

70%

69%

68%

66%

63%

62%

61%

47%

44%

40%

36%

27%

23%

Participating in data related internal

committees

Privacy-related vendor management

Development and training of privacy staff

Assuring proper cross-border data

transfer

Privacy audits

Privacy-related legal counsel (internal)

Ethical decision-making around data use

Privacy-related subscriptions and

publications

Acquiring and/or using privacy-enhancing

software

Preparation for the CCPA

Redress and consumer outreach

Privacy-related web certification and

seals

Accelerating digital transformation and

capabilities

17
Security is about 

protection and availability. 

It requires rules & 

restrictions. 

Privacy is about content, 

context and usage. It 

requires ethics and trust. 

18
19
https://iapp.org/l/infosec-privacy-knowledge/

20
https://iapp.org/l/infosec-privacy-knowledge/

“From a business perspective, the reality is that data about us is 

going to drive everything we do and the way we interact with 

each other,” said Mark Thompson, Global Privacy Advisory Lead 

at KPMG |United Kingdom. “This creates a whole new kind of 

security landscape, which is increasingly centered around PII 

data risk.”

INFOSEC PROFESSIONALS NEED FOR PRIVACY KNOWLEDGE

“The whole idea of ‘reasonable security’ as part of a privacy 

program means it is now the responsibility of security teams 

to understand privacy. And that has been a big shift,” said 

Dana Simberko, Chief Risk, Privacy, and Information Security 

Officer at AvePoint Inc. “Privacy laws have significant 

consequences such as regulatory fines and breach 

requirements that fall squarely on the shoulders of security. 

So, there is really no way you can separate the two domains 

in theory or in practice.”

“The goal is protection,” said Pa. “Only if security and privacy 

functions head in the same direction, can we achieve that 

goal.”

21
Partnership of 

Legal and Tech 

is critical!

22
This is where privacy professionals 

working in the IT and privacy engineering 

fields come together and connect. The Privacy 

Engineering Section offers a range of programs, 

events, content and networking opportunities 

through which privacy pros working in IT and 

related fields can connect and advance.

IAPP PRIVACY ENGINEERING SECTION

Experts in the privacy engineering field are being 

asked to step up and share their expertise. We’re 

looking for speakers to address topics such as user 

interface design, data ethics in artificial intelligence, 

privacy by design, de-identification, implementation 

of privacy technologies and much more.

CALLING ALL PRIVACY ENGINEERS!

23
Q & A 

24
Jonathan Fox

Director, Privacy Engineering

February 19 2020

NICE Webinar

The Intersection of the Privacy 

and Cybersecurity Workforce

25
© 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public

“No matter what market 

you’re in, no matter what 

service you provide or 

product you sell... from 

right now until the end of 

time, you’re in the privacy 

game. Welcome.”

26
Today’s overlap will deepen and grow

27
© 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public

Functions in the data protection ecosystem will grow

Policies & 

Controls

Privacy/Security 

Engineering

Identify & 

Classify 

(Inventory)

Data Risk 

Assessments Remediation

Measurement & 

Enforcement

Monitoring & 

Incident 

Management

Privacy 

Risks

Education and 

Awareness

Education and 

Awareness

CyberSecurity

Risks

28
Marketing

Increased domain expertise will be required

Engineering HR M&A IT Ops

Privacy is contextual 

In addition to increased standardization of privacy roles and responsibilities, we will see the continued rise of 

Privacy SMEs in the different business functions

29
• Data will flow

• New purposes will be imagined

• Risk will continue to need to be managed

• New roles and responsibilities will emerge

The only constant will be change

30
31
Q & A 

32
Thank You for Joining Us!

nist.gov/nice/webinars

33

Upcoming Webinar: “NICE Framework Uses and Success Stories” 

When: Wednesday, March 18, 2020 at 2:00pm EDT 

Register: https://nistnice.adobeconnect.com/webinarmar2020/event/registration.html