NIST Privacy Framework Working Outline February 27, 2019

1

1 NIST Privacy Framework Working Outline

2 Notes to Reviewers 

3

4 This document is provided for discussion purposes to promote input on the NIST Privacy 

5 Framework: An Enterprise Risk Management Tool (Privacy Framework). NIST does not plan to 

6 produce another version of this outline. NIST will use feedback on this outline to develop a

discussion draft of the Privacy Framework.1 7

8 Reading the outline: Plain text indicates preliminary text for the Privacy Framework discussion 

9 draft. Alternatively, italicized text describes what content will be included within a section or for 

10 commentary about how the content is responsive to what NIST has heard from stakeholders, 

11 including responses to the Notice of Request for Information (RFI) released on November 14, 

2018.

2,3 12

13 Based on stakeholder feedback, this outline provides a high-level alignment with the Framework 

14 for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework) to enable greater

15 compatibility between the two frameworks. NIST welcomes feedback on this alignment, 

16 including the level of alignment desired in the Privacy Framework or the appropriateness of the 

17 alignment considering the current guidance needs of the two disciplines.

18

19 The RFI responses indicated that there is not a consistent or widespread understanding of privacy 

20 risk management, so NIST plans to provide a more in-depth treatment of the subject in an 

21 appendix to the Privacy Framework. NIST also included an appendix for a roadmap covering

22 NIST’s next steps and identifying key areas for development of best practices for privacy risk 

23 management.

24

25 At a minimum, NIST would like feedback on whether the organization and content of this 

26 outline is a constructive approach for the Privacy Framework. There are many additional details 

27 that will be provided in the upcoming discussion draft, such as specific categories and 

28 subcategories for the Privacy Framework Core, but NIST also welcomes feedback on what 

29 reviewers would like to see included.

30 Please send feedback on this outline to privacyframework@nist.gov.

 

1 See Development Schedule at https://www.nist.gov/privacy-framework. 2 See Summary Analysis of the Responses to the NIST Privacy Framework Request for Information at 

https://www.nist.gov/privacy-framework. 3 Developing a Privacy Framework: A Notice by the National Institute of Standards and Technology on 11/14/2018, 

https://www.federalregister.gov/documents/2018/11/14/2018-24714/developing-a-privacy-framework.
NIST Privacy Framework Working Outline February 27, 2019

2

31 Table of Contents 

32 Notes to Reviewers................................................................................................................. 1

33 Executive Summary ................................................................................................................ 2

34 1. Privacy Framework Introduction ............................................................................................. 2

35 2. Privacy Framework Basics ....................................................................................................... 3

36 2.1. Privacy Framework Core...................................................................................................... 3

37 2.2. Privacy Framework Profile................................................................................................... 5

38 2.3. Privacy Framework Implementation Tiers ........................................................................... 5

39 3. How to Use the Privacy Framework......................................................................................... 6

40 Appendix A: Privacy Framework Core ..................................................................................... 7

41 Appendix B: Glossary.............................................................................................................. 7

42 Appendix C: Acronyms............................................................................................................ 7

43 Appendix D: Privacy Risk Management .................................................................................. 8

44 Appendix E: Roadmap ............................................................................................................ 8

45

46 Executive Summary 

47

48 The Executive Summary will provide an overview of the Privacy Framework to facilitate an 

49 understanding of its purpose and benefits.

50 1. Privacy Framework Introduction 

51

52 RFI respondents overwhelmingly supported a framework that is risk-based, outcome-based, 

53 voluntary, and non-prescriptive; adaptable to many different organizations, technologies, 

54 lifecycle phases, sectors, and uses; provides a common and accessible language; and is 

55 compatible with and supports organizations' ability to use global standards and operate under 

56 applicable domestic and international legal or regulatory regimes. This introductory section will

57 describe how the Privacy Framework is designed and structured to achieve these attributes. 

58

59 Although the Privacy Framework is aligned with the structure of the Cybersecurity Framework

60 to assist organizations that want to use both frameworks, good cybersecurity practices alone are 

61 not sufficient to address the full scope of privacy risks that can arise from how organizations 

62 collect, store, use, and disclose data (collectively “data processing”) to meet their mission or 

63 business objectives, as well as from how individuals interact with products, services, or systems.

64 Consequently, this section will clarify the relationship and the differences between the 

65 cybersecurity and privacy disciplines to establish the reasoning behind the privacy-specific 

66 adaptations NIST has made for the Privacy Framework. 

67

68 In addition, this section will provide an overview of privacy risk management as a process that 

69 supports organizations’ optimization of beneficial uses of data while minimizing the potential for 
NIST Privacy Framework Working Outline February 27, 2019

3

70 adverse effects on individuals. Notwithstanding this overview, the RFI responses indicated that 

71 there is not a consistent or widespread understanding of privacy risk management. For example, 

72 many RFI responses acknowledged the lack of widely-agreed upon concepts that are essential to 

73 privacy risk management such as a uniform privacy risk model. To address this gap, NIST will 

74 provide a more in-depth treatment of privacy risk management in Appendix D.

75 2. Privacy Framework Basics 

76

77 Following the structure of the Cybersecurity Framework, this section will describe the three 

78 components of the Privacy Framework: the Core, Profiles, and Tiers. In addition to the use of 

79 the Cybersecurity Framework structure, many RFI respondents expressed support for other 

80 organizational constructs such as the information life cycle, privacy principles, and the NIST 

privacy engineering objectives.

4 81 These constructs will be reflected in the elements of the Core as 

82 well.

83 2.1. Privacy Framework Core

84

85 The Privacy Framework Core (Core) will provide a set of activities to achieve specific 

86 privacy outcomes, and reference examples of guidance to achieve those outcomes. The Core is 

87 not a checklist of actions to perform. It will present key privacy outcomes identified by 

88 stakeholders as helpful in managing privacy risk. The Core will comprise four elements: 

89 functions, categories, subcategories, and informative references, depicted in Figure 1: 

90

91

92

93 Figure 1: Privacy Framework Core Structure

94 The functions organize basic privacy activities related to data processing at their highest level. 

95 The functions will be divided into categories closely tied to programmatic needs and 

96 subcategories to support specific outcomes for organizations’ technical or management 

 

4 NIST Internal Report 8062: Introduction to Privacy Engineering and Risk Management in Federal System, at 17,

https://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8062.pdf.
NIST Privacy Framework Working Outline February 27, 2019

4

97 activities. Informative references will provide organizations with guidance in achieving the 

98 outcomes. 

99 The functions are:

100 • Identify – Develop the organizational understanding to manage privacy risk for 

101 individuals arising from data processing or their interactions with products, services, or 

102 systems. 

103 The activities in the Identify function will be foundational for effective use of the Privacy 

104 Framework. Understanding the business context, including the circumstances under 

105 which data is processed, the privacy interests of individuals directly or indirectly served 

106 by the organization, and legal/regulatory requirements will enable an organization to 

107 focus and prioritize its efforts, consistent with its risk management strategy and business 

108 needs. The categories and subcategories will be adapted from the Cybersecurity 

109 Framework Identify function to support privacy risk management practices, and

110 additional categories and subcategories may be included based on stakeholder input. 

111 Examples of outcome categories within this function may include: Asset Management; 

112 Business Environment; Governance; Risk Assessment; and Risk Management Strategy. 

113 • Protect – Develop and implement appropriate data safeguards. 

114 The Protect function encapsulates the overlap between privacy and cybersecurity around 

115 data security and will also include practices aligned with the disassociability privacy 

116 engineering objective. Many of the categories and subcategories may be cross-referenced 

117 from the Cybersecurity Framework. In addition, a number of RFI respondents 

118 encouraged NIST to include practices around de-identification and privacy-enhancing 

119 cryptography. Examples of outcome categories within this function may include: Identity 

120 Management and Access Control; Awareness and Training; Data Security; and De121 identification. 

122 • Control - Develop and implement appropriate activities to enable organizations or 

123 individuals to manage data with sufficient granularity to meet privacy objectives.

124 The Control function considers data management from both the standpoint of the

125 organization and the individual. A number of RFI responses acknowledged this dual 

126 concept of control. This function aligns with the manageability privacy engineering 

127 objective which emphasizes the value of engineering this capability into systems and 

128 products in order to achieve important privacy principles such as accountability, data 

129 minimization, data access (including correction and deletion), individual participation, 

130 and others. Examples of outcome categories within this function may include: Data 

131 Management, Data Quality, Default Configurations, and User Preferences.

132 • Inform - Develop and implement appropriate activities to enable organizations and 

133 individuals to have a reliable understanding about how data is processed.

134 The Inform function recognizes that both organizations and individuals need to know how 

135 data is processed in order to manage privacy risk effectively. This function aligns with 
NIST Privacy Framework Working Outline February 27, 2019

5

136 the predictability privacy engineering objective and supports the key privacy principle of 

137 transparency. A number of RFI responses emphasized the importance of this principle in 

138 both current and emerging technologies. Examples of outcome categories within this 

139 function may include: User Notices, Data Processing Reporting, and Algorithmic 

140 Transparency.

141 • Respond – Develop and implement appropriate activities to take action regarding a

142 privacy breach. 

143 The Respond function supports the ability to provide redress for individuals who have 

144 experienced a privacy breach. Categories and subcategories may be cross-referenced 

145 from the Cybersecurity Framework, and additional categories and subcategories may be 

146 included based on stakeholder input. Examples of outcome categories within this function

147 may include: Redress and Breach Notification. 

148 2.2. Privacy Framework Profile

149

150 The Privacy Framework Profile (“Profile”) is the alignment of the functions, categories, 

151 and subcategories with the business requirements, risk tolerance, privacy objectives, and 

152 resources of the organization. Under the risk-based approach of the Privacy Framework, 

153 organizations may not need to achieve every outcome or activity reflected in the Core. Thus, 

154 when developing a Profile, an organization may select or tailor the functions, categories, and 

155 subcategories of the Privacy Framework to its specific organizational needs. Organizations 

156 determine these needs through consideration of organizational or industry sector goals, 

157 legal/regulatory requirements and industry best practices, the privacy needs of individuals who 

158 are part of—or directly or indirectly served by—an organization, and the organization’s risk 

159 management priorities. A current Profile indicates privacy outcomes that an organization is 

160 currently achieving, while a target Profile indicates the outcomes needed to achieve the desired 

161 privacy risk management goals. The differences between the two Profiles enables an 

162 organization to gauge the resources that would be needed (e.g., staffing, funding) to achieve 

163 privacy goals and forms the basis of an organization’s plan for reducing privacy risk in a cost164 effective, prioritized manner. Profiles also can aid in communicating risk within and between 

165 organizations by helping organizations understand and compare the current or desired state of 

166 privacy outcomes. 

167

168 2.3. Privacy Framework Implementation Tiers

169 The Privacy Framework Implementation Tiers (“Tiers”) provide context on how an 

170 organization views privacy risk and the processes in place to manage that risk. Aligned with the 

171 Cybersecurity Framework, there are four distinct tiers: Partial (Tier 1), Risk Informed (Tier 2), 

172 Repeatable (Tier 3), and Adaptive (Tier 4). Tiers do not represent maturity levels. While 

173 organizations identified as Tier 1 are encouraged to consider moving toward Tier 2, Tiers are 

174 meant to support organizational decision making about how to manage privacy risk by taking 

175 into account the nature of the privacy risks engendered by the organization’s products, services, 

176 or systems and the cost and effectiveness of the risk management practice. Thus, some 

177 organizations may never need to achieve Tier 3 or 4 or may only focus on certain areas of these 

178 tiers. Progression to higher Tiers is necessitated when the nature of the privacy risks requires

179 more multi-faceted risk management practices. Successful implementation of the Privacy 
NIST Privacy Framework Working Outline February 27, 2019

6

180 Framework is based upon achieving the outcomes described in the organization’s Target 

181 Profile(s) and not upon Tier determination. 

182 The Tiers are defined through four areas summarized below. The first two areas are consistent 

183 with the Cybersecurity Framework. NIST has adapted the third area to focus more explicitly on 

184 ecosystem relationships and the role that all entities (e.g., consumer-facing organizations, 

185 service providers, product manufacturers, software developers) play in managing privacy risks 

186 for individuals. NIST has added a fourth area for workforce based on the RFI responses 

187 recognizing that privacy workforce development is a critical need. Although coordination among 

188 various organizations, including academic institutions and training certification organizations,

189 will be necessary to achieve a skilled privacy workforce, organizations using the Privacy 

190 Framework can support this coordination by communicating their privacy risk management 

191 needs and providing demand for the desired skillsets. 

192

193 • Privacy Risk Management Process: Ranging from informal, ad hoc privacy risk 

194 management processes at Tier 1 to processes that enable continuous adaptation 

195 to changing technologies and data processing activities, and incorporate the use 

196 of advanced privacy-enhancing technologies and practices, at Tier 4. 

197

198 • Integrated Privacy Risk Management Program: Ranging from a limited awareness 

199 of privacy risk at the organizational level at Tier 1 to all levels of the organization 

200 being able to make decisions with a clear understanding of the relationship 

201 between privacy risk, other types of risk (including cybersecurity risk), and 

202 organizational objectives at Tier 4. 

203

204 • Ecosystem Relationships: Ranging from the entity does not understand its role in 

205 the larger ecosystem with respect to other entities (e.g. buyers, suppliers, service 

206 providers, business associates or partners, product or service end-users, 

207 regulators) at Tier 1 to the entity understands its role in the larger ecosystem and 

208 contributes to the community’s broader understanding and management of

209 privacy risks at Tier 4. 

210

211 • Workforce: Ranging from a workforce that has little or no understanding of 

212 privacy risks at Tier 1 to a workforce that includes specialized privacy skillsets 

213 throughout the organizational structure at Tier 4. 

214 3. How to Use the Privacy Framework 

215

216 This section covers how organizations can use the Privacy Framework to establish or 

217 improve their privacy risk management practices and communicate them throughout the 

218 organization. As noted by a number of RFI respondents, it will emphasize the importance of 

219 integrating privacy risk management throughout the entire life cycle of data processing, from 

220 collection through disposal. It will provide simple steps for using the Privacy Framework as part 

221 of an organization’s broader risk management approach, including in conjunction with other 

222 risk management frameworks that an organization may be using such as the Cybersecurity 

223 Framework or the Risk Management Framework for Information Systems and Organizations: A 
NIST Privacy Framework Working Outline February 27, 2019

7

System Life Cycle Approach for Security and Privacy.

5 224 The Privacy Framework provides a 

225 common language to communicate privacy requirements. Thus, this section also will include 

226 examples of how organizations can use various components of the Privacy Framework to discuss 

227 privacy requirements with different stakeholders, and inform decisions about buying products 

228 and services—along with how to track and address residual privacy risk once a product or 

229 service is purchased.

230 Appendix A: Privacy Framework Core 

231 This table will be completed with categories, subcategories, and informative references.

232

Functions Categories Subcategories Informative 

References

Identify

Protect

Control

Inform

Respond

233 Appendix B: Glossary 

234 This appendix defines selected terms used in the publication to aid organizations in the use of the 

235 Privacy Framework. This section is not intended to define general usage privacy terms. 

236 Appendix C: Acronyms 

237 This appendix defines selected acronyms used in the publication. 

 

5 NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life 

Cycle Approach for Security and Privacy, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

37r2.pdf.
NIST Privacy Framework Working Outline February 27, 2019

8

238 Appendix D: Privacy Risk Management 

239 This appendix offers a more in-depth discussion of privacy risk management to provide 

240 organizations that do not yet have robust processes with considerations on how to assess and 

241 prioritize privacy risks, and make considered decisions on how to respond to them through the 

242 integration of privacy engineering objectives, privacy principles, and legal/regulatory 

243 requirements into the business environment and system or product development and operations.

244 Appendix E: Roadmap 

245 This appendix will provide a companion roadmap to the Privacy Framework covering NIST’s 

246 next steps and identifying key areas for development of best practices for privacy risk 

247 management. These areas will be based on input and feedback received from stakeholders 

248 through the Privacy Framework development process about outcomes that lack sufficient 

249 informative references or the relevant practices are not well enough understood to enable 

250 organizations to achieve the outcome.