National Institute of Standards and Technology 

Request for Information 

Developing a Privacy Framework 

Prepared for: 

Katie Macfarland 

Prepared by: 

' ~ 

N.I

.., 

NuCrest 

NuCrest, LLC 

613 Maccubbin Lane IGambrills, MD 21054 IPhone 703.375-9308 

Fax 202.204.5206 

Point ofContact: Michael A. Adams, President/CEO 

E-mail: michael.adams@nucrest.com 

www.nucrest.com 

CAGE Code: 382Y3, DUNS: 196117449 

Business Size: Small Disadvantaged Business; 

Service-Disabled Veteran-Owned Small Business (CVE) 

----------------------------- --------------- --------------------- ---------------------------------------------------------------------------. 

This Request for Information includes data that shall not be disclosed outside the Government and shall not be 

duplicated, used, or disclosed-in whole or in part- for any purpose other than to evaluate this response. If, 

however, a contract is awarded to this Offeror as a result of-or in connection with- the submission ofthis data, 

the Government shall have the right to duplicate, use, or disclose the data to the extent provided in the resulting 

contract. This restriction does not limit the Government's right to use information contained in this data if it is 

obtained from another source without restriction. The data subject to this restriction are contained in all sheets of 

this response. 
~ 

~ 

N.J NuCrest ..., 

Subject: Request for Information (RFI) For NIST Developing a Privacy Framework 

To: Ms. Katie MacFarland, 

In response to the Request for Information (RFI) For NIST Developing a Privacy Framework, our firm as 

addressed questions 1 and 5 below. 

• 1. The greatest challenges in improving organizations' privacy protections for individuals; 

Many organizations do not have an understanding ofthe different data types utilized by the end users 

within their organization, received from outside customer systems and residing within their on-premise 

and cloud systems. One of the greatest challenges in improving an organizations' privacy protections 

for individual is a lack oftraining ofindividuals to better the certain types ofdata that require additional 

protection mechanisms. Business System Owners and Information Owners are the key individuals that 

will need to understand that when dealing with data that could have an impact on customers and 

personnel, that the data requires extra security layers. 

• 5. Current policies and procedures for managing privacy risk; 

Policies and procedures for managing privacy risks have existed at organizations that the company has 

supp01ted. Most organizations do not have a single Privacy department responsible for managing and 

disseminating current privacy policies and procedures. At some agencies where there is a Privacy 

Office that is in place, these organizations that we are familiar with do not have an understanding of 

the Federal policies and the NIST 800-53 Privacy Control Families for ensuring privacy requirements 

are met for the agency's information residing in their information systems. Guidance should be created 

requiring an agency to have a general agency Privacy point of contact for overseeing the agency' s 

current compliance with Federal and NIST privacy policies and procedures for handling and managing 

privacy risks. Without this oversight and a central point of contract to provide proper direction and 

instruction, it is hard for organizations to know how to implement current privacy policies and 

procedures to manage privacy risks throughout the organization. While it is up to the organizations to 

create these policies and procedures, it is important to have this as a requirement with guidance given 

on how to fulfill it. 

NuCrest is a Certified Veteran Enterprise (CVE) Service-Disabled Veteran-Owned Small Business 

(SDVOSB), Small Disadvantaged Business (SOB) and Maryland (MD) Disadvantaged Business Enterprise 

(DBE) certified firm located in the Washington DC metro area. Our website is www.nucrest.com 

If you require additional information or have questions, please do not hesitate to contact me at 703-375-

9308 or via email at michael.adams@nucrest.com. 

Re,~ctfu,, 1) / 

/~tf~?tf~ 

Michael A. Adams 

President/CEO 

NuCrest, LLC