Privacy Framework Discussion Draft Core Comparison

1

Comparison of the Privacy Framework Discussion Draft and the Cybersecurity 

Framework Cores 

NIST received support from stakeholders to align the structure of the Privacy Framework with the 

Cybersecurity Framework (CSF).

1 At the same time, stakeholders also wanted the flexibility to be able to 

use the Privacy Framework as a standalone document. NIST developed this document to facilitate

discussion of the overlap and differences between the two frameworks at its workshop, Drafting the 

NIST Privacy Framework: Workshop #2.

2 As set forth in the Privacy Framework discussion draft, privacy 

risks overlap with data security risks; therefore, many of the CSF core components remain applicable to 

the Privacy Framework.

3

Privacy risks also arise as a byproduct of authorized data processing, as such, some of the Privacy 

Framework Core components are unique while others can be mapped to CSF core components with 

some variations to account for privacy risks arising from authorized data processing. Tables 1 and 2 

provide a comparison of the frameworks at the function, category, and subcategory level. 

Table 1: Core Function and Category Comparison 

Note: * indicates that the Privacy Framework Category and the CSF Category are identical

1 See Framework for Improving Critical Infrastructure Cybersecurity, https://doi.org/10.6028/NIST.CSWP.04162018

2 See https://www.nist.gov/news-events/events/2019/05/drafting-nist-privacy-framework-workshop-2

3 See Figure 2, NIST Privacy Framework: An Enterprise Risk Management Tool (Discussion Draft), 

https://www.nist.gov/document/nist-privacy-framework-discussion-draftpdf

Privacy Framework

FUNCTION | Category

Cybersecurity Framework

FUNCTION | Category

IDENTIFY

Inventory and Mapping (ID.IM-P) Inventory and Asset Management (ID.AM) 

Business Environment (ID.BE-P) Business Environment (ID.BE) 

Governance (ID.GV-P) Governance (ID.GV) 

Risk Assessment (ID.RA-P) Risk Assessment (ID.RA)

Risk Management Strategy (ID.RM-P)* Risk Management Strategy (ID.RM)*

Supply Chain Risk Management (ID.SC-P) Supply Chain Risk Management (ID.SC)

PROTECT

Identity Management, Authentication, and Access 

Control (PR.AC-P)

Identity Management, Authentication and 

Access Control (PR.AC)

Awareness and Training (PR.AT-P) Awareness and Training (PR.AT)

Data Security (PR.DS-P) Data Security (PR.DS)

Data Protection Processes and Procedures (PR.DPP)Information Protection Processes and 

Procedures (PR.IP)

Maintenance (PR.MA-P) Maintenance (PR.MA)

Protective Technology (PR.PT-P) Protective Technology (PR.PT)

Protected Processing (PR.PP-P) Protective Technology (PR.PT)

CONTROL

None Data Management Processes and Procedures 

(CT.PO-P)

Data Management (CT.DM-P)
Privacy Framework Discussion Draft Core Comparison

2

Table 2: Core Subcategory Comparison

Note: * indicates that the Privacy Framework Subcategory and the CSF Subcategory are identical

Privacy Framework

Function | Category | Subcategory

Cybersecurity Framework 

Subcategory

Identify

IM

ID.IM-P1 ID.AM-1, ID.AM-2 

ID.IM-P2 ID.AM-1, ID.AM-4 

ID.M-P3 ID.AM-1, ID.AM-2, ID.AM-4

ID.IM-P4 None

ID.IM-P5 ID.AM-1, ID.AM-2, ID.AM-4

ID.IM-P6 ID.AM-3, DE.AE-1

BE

ID.BE-P1* ID.BE-1*

ID.BE-P2* ID.BE-3*

ID.BE-P3 ID.BE-4

GV

ID.GV-P1 ID.GV-1

ID.GV-P2 None

ID.GV-P3 ID.GV-2

ID.GV-P4 ID.GV-2 

ID.GV-P5 ID.GV-3

ID.GV-P6 ID.GV-4

RA

ID.RA-P1 None

ID.RA-P2 None

ID.RA-P3 ID.RA-3

ID.RA-P4 ID.RA-4, ID.RA-5

Privacy Framework

FUNCTION | Category

Cybersecurity Framework

FUNCTION | Category

INFORM

Transparency Processes and Procedures (IN.TP-P) None

Data Processing Awareness (IN.AW-P) 

None

DETECT

Anomalies and Events (DE.AE)

Security Continuous Monitoring (DE.CM)

Detection Processes (DE.DP)

RESPOND

Response Planning (RS.RP-P) Response Planning (RS.RP)

Communications (RS.CO-P)* Communications (RS.CO)*

Analysis (RS.AN-P) Analysis (RS.AN)

Mitigation (RS.MI-P) Mitigation (RS.MI)

Improvements (RS.IM-P) Improvements (RS.IM)

Redress (RS.RE-P) None

None

RECOVER

Recovery Planning (RC.RP)

Improvements (RC.IM)

Communications (RC.CO)
Privacy Framework Discussion Draft Core Comparison

3

Privacy Framework

Function | Category | Subcategory

Cybersecurity Framework 

Subcategory

ID.RA-P5* ID.RA-6*

ID.RA-P6 None

RM

ID.RM-P1* ID.RM-1*

ID.RM-P2* ID.RM-2*

ID.RM-P3 ID.RM-3

SC

ID.SC-P1 ID.SC-1

ID.SC-P2 ID.SC-2

ID.SC-P3 ID.SC-3

ID.SC-P4 ID.SC-4

ID.SC-P5 ID.SC-5

Protect

AC

PR.AC-P1 PR.AC-1

PR.AC-P2 PR.AC-2

PR.AC-P3* PR.AC-3*

PR.AC-P4* PR.AC-4*

PR.AC-P5* PR.AC-5*

PR.AC-P6 PR.AC-6, PR.AC-7

PR.AC-P7 PR.AC-6

AT

PR.AT-P1* PR.AT-1*

PR.AT-P2* PR.AT-2*

PR.AT-P3 PR.AT-3

PR.AT-P4* PR.AT-4*

PR.AT-P5 PR.AT-5

DS

PR.DS-P1* PR.DS-1*

PR.DS-P2* PR.DS-2*

PR.DS-P3 PR.DS-3

PR.DS-P4* PR.DS-4*

PR.DS-P5* PR.DS-5*

PR.DS-P6* PR.DS-6*

PR.DS-P7* PR.DS-7*

PR.DS-P8* PR.DS-8*

DP

PR.DP-P1 PR.IP-1

PR.DP-P2 PR.IP-2

PR.DP-P3* PR.IP-3*

PR.DP-P4* PR.IP-4*

PR.DP-P5* PR.IP-5*

PR.DP-P6* PR.IP-6*

PR.DP-P7* PR.IP-7*

PR.DP-P8* PR.IP-8*

PR.DP-P9* PR.IP-9*

PR.DP-P10* PR.IP-10*

PR.DP-P11 PR.IP-11

PR.DP-P12* PR.IP-12*

MA

PR.MA-P1* PR.MA-1*

PR.MA-P2* PR.MA-2*
Privacy Framework Discussion Draft Core Comparison

4

Privacy Framework

Function | Category | Subcategory

Cybersecurity Framework 

Subcategory

PT

PR.PT-P1 PR.PT-1

PR.PT-P2* PR.PT-2*

PR.PT-P3* PR.PT-3*

PR.PT-P4* PR.PT-4*

PR.PT-P5* PR.PT-5*

PP

PR.PP-P1 None

PR.PP-P2 None

PR.PP-P3 None

PR.PP-P4 None

PR.PP-P5 None

Control

PO

CT.PO-P1 None

CT.PO-P2 None

CT.PO-P3 None

DM

CT.DM-P1 None

CT.DM-P2 None

CT.DM-P3 None

CT.DM-P4 None

CT.DM-P5 None

CT.DM-P6 None

CT.DM-P7 None

CT.DM-P8 None

Inform

TP

IN.TP-P1 None

IN.TP-P2 None

AW

IN.AW-P1 None

IN.AW-P2 None

IN.AW-P3 None

IN.AW-P4 None

IN.AW-P5 None

IN.AW-P6 None

IN.AW-P7 None

Respond

RP RS.RP-P1 RS.RP-1

CO

RS.CO-P1* RS.CO-1*

RS.CO-P2 RS.CO-2

RS.CO-P3* RS.CO-3*

RS.CO-P4* RS.CO-4*

RS.CO-P5 RS.CO-5

RS.CO-P6 None

AN

RS.AN-P1 RS.AN-1

RS.AN-P2 RS.AN-2

RS.AN-P3* RS.AN-3*

RS.AN-P4 RS.AN-4

RS.AN-P5 RS.AN-5

MI

RS.MI-P1 RS.MI-1

RS.MI-P2 RS.MI-2
Privacy Framework Discussion Draft Core Comparison

5

Privacy Framework

Function | Category | Subcategory

Cybersecurity Framework 

Subcategory

RS.MI-P3 RS.MI-3

IM RS.IM-P1 RS.IM-1, RS.IM-2

RE

RS.RE-P1 None

RS.RE-P2 None