Getting to V1.0 of the 

NIST Privacy Framework: 

Workshop #3

July 8, 2019
Process to Date

Feedback encouraged and promoted throughout the process

ONGOING ENGAGEMENT

October 

16, 2018

Austin, TX

November 

14, 2018 –

January 14, 

2019

February 

27, 2019

April 30, 

2019

May 13-14, 

2019

Atlanta, GA

July 8-9, 

2019

Boise, ID

June 26, 

2019

Workshop 

#1

Request for 

Information 

(RFI)

RFI Analysis 

& Framework 

Outline

Framework 

Discussion 

Draft

Workshop 

#2

Workshop 

#3

Supplemental 

Materials
Materials for Working Sessions

Updated 

Cores

Integrated 

version

Separated 

version

Hypothetical 

Profiles

Roadmap 

Topics

Sessions 1-3 and 6

Sessions 4-5

Draft 

Executive 

Summary
WORKSHOP OBJECTIVE #1

Material: Draft Executive Summary

Purpose, value, & scope
Value

The Privacy Framework provides a shared lexicon and is a

practical tool that can assist organizations—even those fully

compliant with relevant laws or regulations—in making

ethical decisions when designing or deploying their

products and services and avoiding losses of trust that

damage their reputations and can slow adoption or cause

abandonment of these products and services.
Relationship Between Cybersecurity and 

Privacy Risk

Cybersecurity 

Risks

Privacy 

Risks

arise from 

unauthorized 

activity

arise as a 

byproduct of 

authorized data 

processing

data

security 

(including

unauthorized 

use & 

disclosure)

Data: A representation of information, 

including digital and non-digital formats, 

with the potential for adverse 

consequences for individuals when 

processed

Data Action: A system/product/service 

operation that processes data

Data Processing: An operation or set of 

operations performed upon data across 

the full data life cycle, including but not 

limited to collection, retention, logging, 

generation, transformation, use, disclosure, 

transfer, and disposal

Privacy Risk: The likelihood that 

individuals will experience problems 

resulting from data processing, and the 

impact should they occur
Privacy Risk and Organizational Risk

Problem Individual

arises from data 

processing

experiences direct 

impact

(e.g., embarrassment, 

economic loss)

Organization

experiences secondary 

impact

(e.g., customer abandonment, 

noncompliance costs, harm to 

reputation)
WORKSHOP OBJECTIVE #2

Material: Updated Cores

Risk-based & flexible
Privacy & Cybersecurity Framework 

Alignment

a set of protection 

activities & desired 

outcomes that 

enables 

communication 

across the 

organization

representation of the 

current and target 

outcomes the 

organization is 

focused on

how an organization 

views risk and 

whether it has 

adequate processes 

& resources in place 

to manage that risk

Profiles

Tiers

Core
PROTECT

DETECT RESPOND RECOVER

CONTROL COMMUNICATE

IDENTIFY GOVERN IDENTIFY GOVERN

PROTECT CONTROL COMMUNICATE

DETECT RESPOND RECOVER

Integrated Core Separated Core

Two Proposed Cores
Flexible Implementation

Not a checklist: organizations may not need to achieve 

every outcome or activity reflected in the Core

Partial achievement: organizations are not obligated to 

achieve an outcome in its entirety

Bundling: organizations may need to consider multiple 

outcomes in combination to appropriately manage privacy 

risk

Order: table format of Core is not intended to suggest an 

implementation order or degree of importance
WORKSHOP OBJECTIVE #3

Material: Hypothetical Profiles

Accessibility & efficacy for 

bridging communication 

gaps
Finding Yourself in the Core
Collaboration & Profile Development

• organizational or industry sector goals

• legal/regulatory requirements & industry best practices

• organization’s risk management priorities

• the privacy needs of individuals

Current Profile

Identify

Protect

Control

Communicate

Govern

Target Profile

Identify

Protect

Control

Communicate

Respond

Govern

cross

-functional 

collaboration
Hypothetical Partial Profile

Govern

Governance 

Processes and 

Procedures 

GV.PP-P5: Legal, 

regulatory, and 

contractual 

requirements...

CT.DM-P1: Data 

elements can be 

accessed for review.

Identity 

Management, 

Authentication, and 

Access Control 

CT.DM-P4: Data 

elements can be 

accessed for 

deletion.

PR.DP-P6: Data are 

destroyed 

according to policy.

CT.DM-P6: Metadata 

containing 

processing 

permissions...

ID.DE-P3: Contracts 

with data processing 

ecosystem 

parties are used...

Identify

Inventory and 

Mapping

ID.IM-P8: Data 

processing is 

mapped...

Risk Assessment

PR.PP-P1: Data are 

processed in an 

unobservable or 

unlinkable manner. Key:

Current Profile

Target Profile
WORKSHOP OBJECTIVE #4

Material: Roadmap Topics

Gap areas & needs
Laying the Groundwork for the Future

Seeking to improve and overcome challenges around:

• Mechanisms to provide confidence

• Emerging technologies

• Privacy risk assessment

• Privacy workforce

• Re-identification risk

• Technical standards
Resources

Website

https://nist.gov/privacyframework

Mailing List 

https://groups.google.com/a/list.nist.gov/forum/#!forum/privacyframework 

Contact Us 

PrivacyFramework@nist.gov 

@NISTcyber #PrivacyFramework