From: Mark Bohannon <markb@redhat.com>

Sent: Friday, October 18, 2019 9:14 AM

To: privacyframework <privacyframework@nist.gov>

Cc: Brian Klemm <bklemm@redhat.com>; Jamie de Vries <jadevrie@redhat.com>; Dwayne 

Strange <dstrange@redhat.com>; Gina Likins <glikins@redhat.com>

Subject: Red Hat, Inc. comments on Draft Privacy Framework

Dear NIST Team,

Please find attached our comments on the latest Draft Privacy Framework. Overall, very 

encouraged by this initiative. We have some specific suggestions (which are identified by line in 

the Table) for clarification. With regard to the definitions, we might want to have a quick call to 

go over some of the points we've highlighted in the submission.

All the best, Mark

*************************************************************

This is a Message from:

Mark Bohannon

Vice President, Global Public Policy

 & Government Affairs

Red Hat, Inc.

Desk: 202-220-3170

Mobile: 202-413-1365

markb@redhat.com
 

 

 

 

 

Response of

Red Hat, Inc. (“Red Hat”)

to the Preliminary Draft “NIST Privacy Framework:

A Tool For Improving Privacy Through

Enterprise Risk Management”

(posted September 6, 2019)

Published by the National Institute of Standards and Technology (“NIST”) at:

https://www.nist.gov/sites/default/files/documents/2019/09/09/nist_privacy_framework_prelimi

nary_draft.pdf

[October 18, 2019]

Red Hat appreciates the opportunity to comment on the above-referenced matter. Red Hat is a

leading provider of open source software solutions, using a community-powered approach to deliver

resilient and high-performing cloud, Linux, middleware, storage and virtualization technologies.

Red Hat has a deep interest in this area. Our customers are demanding high-quality, trusted and

affordable technology solutions that are found throughout mission-critical systems in the financial,

transportation, telecommunications and government (civilian and defense) sectors in the United

States and around the world. Red Hat is recognized as one of the world's most innovative companies.

Introduction

We recognize that NIST has already provided specific guidance on cybersecurity best practices

through its Framework for Improving Critical Infrastructure Cybersecurity, which was most recently

1 See Forbes, “The World’s Most Innovative Companies”, 2018, found at: https://www.forbes.com/companies/red-hat/.

601 Pennsylvania Avenue, NW Suite 900 North Building Washington, DC 20004

1
 

 

 

 

 

 

updated in April 2018 (the “Cybersecurity Framework”).2 Robust security practices and controls are

crucial for protecting individuals’ privacy, and therefore, cybersecurity tools should serve as an

integral part of a successful Privacy Framework. To that end, we have urged the advancement of a

reasonable, risk-based3 Privacy Framework in which effective security principles are incorporated as

a key component (and thereby enable consistent risk management across both data protection and

cybersecurity). In our view, this Draft Framework has taken strong steps to achieve that goal.

We offer a number of suggestions below to clarify and improve the Draft Framework.

Ref to Draft

White

Paper: Line

Comment

124 Would rephrase for clarity and better alignment with the Cybersecurity Framework:

Organizations also may not fully realize the risk and consequences associated with

individuals’ privacy.

196-201 Question: Should there be a reference to taxonomy? Line 135 reads “common

language”

232 Add at end of sentence for clarity: ...their privacy was intruded on or surveilled

238 Add at end of sentence for clarity: ...from data processing

239-240 Add at end of sentence for clarity: ...it can assess the impact should a problematic

data action occur. This Privacy Impact assessment.

243 Add at end of sentence for clarity: ...and regulatory fines and penalties

244 Question: This is the first mention of “brand”. Should be also referenced in the

executive summary.

252 Add the following for clarity: In general, privacy risk and privacy impact assessments

should produce...

607 Add at end of sentence for clarity: ...trade-off, mitigation,

2 National Institute Of Standards And Technology, FRAMEWORK FOR IMPROVING CRITICAL INFRASTRUCTURE

CYBERSECURITY, VERSION 1.1 (April 16, 2018), available at https://nvlpubs.nist.gov/nistpubs/

CSWP/NIST.CSWP.04162018.pdf.

3 Effective privacy solutions require an integrated approach to data security, including practices that promote

interoperability and data sharing to enable effective threat analysis. Privacy and security frameworks must promote

technology neutral, risk-based solutions that encourage accountability, innovation, and efficiency. It is essential that the

Privacy Framework should reflect this general approach.

2
683 Should this be before the Venn diagram? Doing so would go further to explain the

reason for ID-P, PE, RS, and RC

Appendix B

Glossary at

line 687

Comment and suggestion for definition of “privacy breach”: it does not appear to

fully align with how such terms are characterized in legislation. Examples of such

terms include "data processing" and "privacy breach." Perhaps use of different

terms (e.g., "privacy incident") might help to avoid unnecessary confusion.

Red Hat looks forward to collaborating with NIST as it reviews the comments received and considers

how to expand on this important effort. In particular, NIST and the public would be well served to

highlight how to effectively implement through operational examples and repository of experiences (in

a variety of sectors) via workshops, webcasts, etc. as a follow on. This should include leveraging

concrete operational accomplishments with the Cybersecurity Framework.

Once again, we appreciate this opportunity to provide our comments on this Draft Framework. Please

do not hesitate to contact us if we can provide further information or answer questions.

Contact:

Mark Bohannon Jamie De Vries

Vice President, Global Public Policy

Red Hat, Inc.

markb@redhat.com

Manager, Data Security and Privacy

Red Hat, Inc.

jadevrie@redhat.com

Brian Klemm

Senior Managing Counsel

Red Hat, Inc.

bklemm@redhat.com

3