Kicking off the NIST Privacy Framework: Workshop #1

CAPITAL FACTORY IN AUSTIN, TEXAS | OCTOBER 16, 2018, 2:30-5:30 PM CT

Agenda

Time Topic

2:30 PM Opening Remarks 

Donna Dodson, Chief Cybersecurity Advisor, NIST

2:40 PM Panel Discussion #1: Introduction to the Privacy Framework

Learn about NIST’s objectives and the process for developing the Privacy 

Framework. Take the opportunity to ask questions of NIST leadership on this effort.

Panelists:

• Naomi Lefkovitz, Senior Privacy Policy Advisor, NIST

• Donna Dodson, Chief Cybersecurity Advisor, NIST

• Kevin Stine, Chief of the Applied Cybersecurity Division, NIST

3:15 PM Panel Discussion #2: Attributes of the Privacy Framework 

Panelists will share cross-sector perspectives on what needs the Privacy 

Framework should address, as well as key attributes and structure of an effective 

privacy framework. Discussion topics will include: characteristics of a risk- and 

outcome-based privacy framework, creating a framework that’s understandable 

by non-privacy professionals, and supporting organizations’ ability to operate in 

different jurisdictions.

Moderator: Marc Groman, Principal, Groman Consulting Group LLC

Panelists:

• Ron Whitworth, Senior Vice President and Chief Privacy Officer, SunTrust

• Kent Landfield, Chief Standards and Technology Policy Strategist, McAfee

• Sarah Morrow, Chief Privacy Officer, Texas Health and Human Services

• Michelle Dennedy, Vice President and Chief Privacy Officer, Cisco

4:10 PM Break

4:20 PM Panel Discussion #3: Core Privacy Practices

Panelists will explore practices for inclusion in the NIST Privacy Framework. Panelists 

will leverage their own experiences implementing different privacy practices and 

discuss the maturity of these practices, gaps, and how to structure a framework to 

help advance implementation of better privacy solutions.

Moderator: Rebecca Herold, CEO, The Privacy Professor; Founder, SIMBUS, LLC

Panelists:

• Sagi Leizerov, Chief Data Solutions Officer, Prifender

• Charlie Cabot, Research Lead, Privitar

• Maritza Johnson, UX Principal, Good Research; Researcher, ICSI

• Michelle Richardson, Director, Privacy and Data Project, Center for 

Democracy and Technology (CDT)

5:15 PM Recap of the Day and Next Steps

Kevin Stine, Chief, Applied Cybersecurity Division, NIST
Kicking off the NIST Privacy Framework: Workshop #1

CAPITAL FACTORY IN AUSTIN, TEXAS | OCTOBER 16, 2018, 2:30-5:30 PM CT

Speaker Bios

Charlie Cabot Charlie Cabot leads the research and data 

science team at Privitar, working on solving industry problems with 

privacy enhancing technologies. Charlie focuses on formal privacy 

models, risk metrics, and the statistical impact of anonymization on 

analytics and data science. He has led data privacy consulting 

projects for clients across industries, and worked on productizing state 

of the art privacy techniques. Previously, working in cyber security, 

Charlie engineered machine learning-driven approaches to malware 

detection and modeled cyber attacks on computer networks.

Michelle Dennedy Michelle Finneran Dennedy is Vice President 

and Chief Privacy Officer at Cisco, where she works to raise awareness 

and create tools that promote privacy, quality, respect, trust, and 

asset-level possibilities for data. She is a unique visionary in the field of 

privacy and the IT industry, bringing together multifaceted approaches 

that provide sincere privacy protections and drive business value.

Throughout her career, Dennedy has led security and privacy 

initiatives, ranging from regulatory compliance, privacy engineering, 

advocacy and education efforts, and litigation at companies 

including Cisco, and previously McAfee/Intel Security, Oracle, and Sun Microsystems. She 

founded The iDennedy Project, which seeks to change how people think about information 

and data, and co-authored The Privacy Engineer's Manifesto: Getting from Policy to Code to 

QA to Value. She hosts a podcast, Privacy Sigma Riders, which focuses on cybersecurity, trust, 

and data privacy issues. Dennedy is a highly sought-after public speaker who sits on the 

boards of the International Association of Privacy Professionals (IAPP) and the National Multiple 

Sclerosis Society of Northern California. She has been honored with many industry awards 

including California’s Most Powerful and Influential Women, by the National Diversity Council; 

the IAPP Vanguard Award; Woman of Influence for Security and Privacy, from the Executive 

Women’s Forum (EWF) and CSO Magazine; Woman of the Year in Technology and 

Transformation, by the Stevie American Business Awards, and most recently, World Women 

Awards Silver Winner for Female Executive of the Year for her leadership in optimizing Cisco’s 

privacy maturity. Dennedy has a Doctorate of Law degree from Fordham University and a 

Bachelor of Science degree in Clinical, Counseling and Applied Psychology and Economics 

from The Ohio State University.

Donna Dodson Donna Dodson is a pioneer and recognized 

leader in the U.S. Government’s efforts to address cybersecurity 

challenges. As NIST’s Chief Cybersecurity Advisor, Donna provides 

leadership and vision for all cybersecurity research programs at NIST. 

She is the primary technical expert and management advisor for 

cybersecurity for NIST and the Department of Commerce and is a key 

cybersecurity leader for the Administration and the Nation. Since 

joining NIST in 1987, Donna has been selected as a Fed 100 winner for 

innovations in cybersecurity, as one of the top 10 influential people in 

government IT in 2011, and as one of Fed Scoop’s Top 50 D.C. Women in Tech.
Kicking off the NIST Privacy Framework: Workshop #1

CAPITAL FACTORY IN AUSTIN, TEXAS | OCTOBER 16, 2018, 2:30-5:30 PM CT

Marc Groman Marc Groman is an internationally recognized 

expert in privacy, cyber security, and data strategy. In 2015, Mr. 

Groman was appointed Senior Advisor for Privacy in the White House 

Office of Management and Budget, where he had government-wide 

responsibility for privacy policy. During that time he served as the 

Chairman of the Federal Privacy Council established by President 

Obama, and as the privacy lead on the President’s Cyber Security 

National Action Plan. Mr. Groman’s vision and innovative approach to 

addressing data privacy issues while in the White House earned him the 

International Association of Privacy Professional’s 2017 Leadership Award. Since the end of his 

tenure at OMB, Mr. Groman has been advising senior leaders in business and government on 

mission-critical policy, risk management, and data strategy issues. Currently he is working with 

the World Economic Forum drafting a global data policy framework, supporting efforts to craft 

federal privacy legislation in the United States, and teaching a seminar on data breach 

response at Georgetown University Law Center. Prior to working in the Obama Administration, 

Mr. Groman served in numerous leadership positions including President and CEO of the 

Network Advertising Initiative, Chief Privacy Officer of the Federal Trade Commission, and 

Privacy Counsel to the Energy and Commerce Committee of the House of Representatives. 

He currently serves on the National Security Agency Privacy Advisory Panel and the National 

Institute of Standards and Technology Information Security and Privacy Advisory Board, as well 

as numerous other boards and advisory councils. Mr. Groman received his BA from Tufts 

University and his JD from Harvard Law School. Marc Groman is a frequent and entertaining 

speaker on issues relating to privacy, technology, and innovation. Incorporating his 

professional skills with what he has “learned” in his role as a parent, in November of this year 

you will be able to listen to Mr. Groman on his new podcast, Their Own Devices. On this timely 

new series, Mr. Groman will draw on his professional expertise and parenting challenges to 

discuss the “ups and downs” of raising kids in the digital age.

Rebecca Herold Rebecca (FIP, CISSP, CIPP/US, CIPT, CIPM, CISM, 

CISA, FLMI, Ponemon Institute Fellow) has 25+ years of IT, information 

security & privacy experience, is CEO of The Privacy Professor® 

consultancy & President/Founder of SIMBUS, LLC Information Security, 

Privacy & Compliance cloud services. Rebecca has authored 19 books 

and contributed to hundreds of other books & articles. Rebecca led 

the NIST Smart Grid Privacy Subgroup for 7 years, is co-founder of IEEE 

P1912, and is on many advisory boards. Rebecca was Adjunct 

Professor for Norwich University MSISA program for 9 years, has received 

numerous awards & keynoted on 5 continents. Rebecca hosts VoiceAmerica radio show 

“Data Security & Privacy with the Privacy Professor.” Rebecca is based in Des Moines, Iowa, 

USA.
Kicking off the NIST Privacy Framework: Workshop #1

CAPITAL FACTORY IN AUSTIN, TEXAS | OCTOBER 16, 2018, 2:30-5:30 PM CT

Maritza Johnson Dr. Maritza Johnson is a UX Principal with Good 

Research and a Researcher at ICSI with a specialty in security and 

privacy. She aims to help people better understand the security and 

privacy decisions they encounter in their daily lives, and she's 

particularly interested in how people think about data. In the past she 

was a user experience researcher on Google’s Identity team. Prior to 

that she was a technical privacy manager at Facebook. She 

completed her PhD in computer science at Columbia University and 

wrote her dissertation on end-user access control management with a 

focus on Facebook privacy settings.

Kent Landfield Kent Landfield has spent 30+ years in software 

development, global network operations and network security arenas. 

Currently he is the Chief Standards and Technology Policy Strategist at 

McAfee. Kent has been active in the NIST Cybersecurity Framework 

development, participating and presenting in workshops, coordinating 

Intel’s and McAfee’s responses and providing global policy and 

educational outreach in multiple countries. While at Intel, he initiated 

and co-authored of ‘The Cybersecurity Framework in Action: And Intel 

Use Case’. Kent has been a participating member of multiple 

subcommittees of the President’s National Security Telecommunications Advisory Committee 

(NSTAC) efforts. He has worked on multiple cyber threat information sharing research, 

standards and development efforts and co-authored the IETF’s RFC 7203, An Incident Object 

Description Exchange Format (IODEF) Extension for Structured Cybersecurity Information. He 

currently Co-Chairs the ISAO SO Information Sharing Working Group and the NTIA Software 

Transparency Standards & Formats Working Group. Previously as Director of Content Strategy, 

Architecture and Standards for McAfee Labs, Kent was the chief McAfee Labs Vulnerability 

Group Architect, as well as one of McAfee’s Principal Architects. Kent was one of the founding 

members of the CVE Editorial Board, chairs the CVE Strategy Working Group and is currently 

involved with multiple global vulnerability related standards efforts. He has been active in 

Security Content Automation Protocol (SCAP) related security automation efforts. Kent holds 

patents in DNS, Email and Software Patch Distribution technologies.

Naomi Lefkovitz Naomi Lefkovitz is the Lead for the Privacy 

Framework and Senior Privacy Policy Advisor in the Information 

Technology Lab at the National Institute of Standards and Technology, 

U.S. Department of Commerce. She leads the privacy engineering 

program, which focuses on developing privacy risk management 

processes and integrating solutions for protecting individuals’ privacy 

into information technologies, including digital identity services, IoT, 

smart cities, big data, mobile, and artificial intelligence.

FierceGovernmentIT named Ms. Lefkovitz on their 2013 “Fierce15” list of 

the most forward-thinking people working within government information technology, and she 

is a 2014 and 2018 Federal 100 Awards winner. Before joining NIST, she was the Director for 

Privacy and Civil Liberties in the Cybersecurity Directorate of the National Security Council in 

the Executive Office of the President. Her portfolio included the National Strategy for Trusted 

Identities in Cyberspace as well as addressing the privacy and civil liberties impact of the 

Obama Administration’s cybersecurity initiatives and programs. Prior to her tenure in the 
Kicking off the NIST Privacy Framework: Workshop #1

CAPITAL FACTORY IN AUSTIN, TEXAS | OCTOBER 16, 2018, 2:30-5:30 PM CT

Obama Administration, Ms. Lefkovitz was a senior attorney with the Division of Privacy and 

Identity Protection at the Federal Trade Commission. Her responsibilities focused primarily on 

policy matters, including legislation, rulemakings, and business and consumer education in the 

areas of identity theft, data security and privacy. At the outset of her career, she was Assistant 

General Counsel at CDnow, Inc., an early online music retailer. Ms. Lefkovitz holds a B.A. with 

honors in French Literature from Bryn Mawr College and a J.D. with honors from Temple 

University School of Law.

Sagi Leizerov Sagi has 20 years of privacy and data governance 

experience. As Prifender’s Chief Data Solutions Officer, Sagi works with 

our customers to maximize the capabilities of our technology in their 

technical environment and operational needs. Sagi is also a Board

Director of the International Association of Privacy Professionals. Before 

joining Prifender, Sagi was Ernst & Young’s Global Privacy Leader for 

privacy assurance and consulting services. In his 16 years at Ernst & 

Young, Sagi served Fortune 100 and Fortune 500 companies from 

industries ranging from financial services, pharmaceutical, technology, 

manufacturing and automotive. He is a frequent speaker in data-related conferences and his 

articles appear in business and professional publications.

Sarah Morrow A Privacy advocate, Sarah has several years of 

industry and regulatory compliance experience, 5 years specifically in 

Higher Education as Chief Privacy Officer for The Pennsylvania State 

University. Additionally, she spent 2 years as a privacy consultant for the 

Smithsonian Institution, consulted for State Farm Family of Companies 

as an employee of TEK Systems, then worked as University of New 

Mexico's HSC Chief Privacy Officer. Currently, Sarah continues to work 

in privacy as the Texas Health and Human Services system Chief 

Privacy Officer. She has a Bachelor of Arts in Art History from Mills 

College, a Paralegal Certification from the University of San Diego, School of Law, and a MBAISM (Information Security Management) Summa cum Laude from Jones International 

University. She maintains designations as a CIPP/US (Certified Information Privacy Professional), 

CIPM (Certified Information Privacy Manager) and GISP (GIAC Information Security 

Professional). After twenty+ years, Sarah retired from her first career as a professional 

equestrian and entered the world of regulatory compliance through the mortgage banking 

industry. Sarah is a two time member of DHS's Data Privacy and Integrity Advisory Committee 

(DPIAC); She was the first Chair of the of the International Association of Privacy Professional's 

(IAPP) Foundation Certification Exam Development Board and a former member of the 

Education Advisory Board, is a co-Founder of and was co-Chair of the Higher Education -

Chief Privacy Officers (HE-CPO) group sponsored by EDUCAUSE, was co-Chair of the IAPP's 

Philadelphia Area Knowledge Net, was co-Founder and Chair of Columbia Area (South 

Carolina) Knowledge Net; She presented to audiences of the IAPP's Global Privacy Summit 

(March 2010), IAPP Knowledge Net (regional meeting), Internet 2's In Common CAMP (June 

2010& 2011) and at EDUCAUSE (Annual conference Fall 2011). Most recently, she presented at 

IAPP's Global Privacy Summit in March of 2012 and at the EDUCAUSE Security Conference in 

May of 2012 participating in two sessions, in 2014, Sarah delivered Ethics training for MCLE 

credit at the IAPP Summit. In 2016 Sarah presented to Society of Corporate Compliance and 

Ethics' (SCCE) Higher Education Conference on establishing and maintaining a privacy 

program. She has authored articles for both the IAPP and SCCE.
Kicking off the NIST Privacy Framework: Workshop #1

CAPITAL FACTORY IN AUSTIN, TEXAS | OCTOBER 16, 2018, 2:30-5:30 PM CT

Michelle Richardson Michelle Richardson is the Director of 

Privacy and Data at the Center for Democracy and Technology, a 

nonprofit advocacy organization that fights for privacy, security, and 

freedom of expression in the digital world. Michelle's team focuses on 

corporate practices and advocates for technology and policies that 

empower users, respect their privacy and treat them fairly.

Kevin Stine Mr. Kevin Stine is the Chief of the Applied 

Cybersecurity Division in the National Institute of Standards and 

Technology’s Information Technology Laboratory. In this capacity, he 

leads NIST collaborations with industry, academia, and government 

on the practical implementation of cybersecurity and privacy through 

outreach and effective application of standards and best practices. 

The Applied Cybersecurity Division develops cybersecurity and privacy 

guidelines, tools, and reference architectures in diverse areas such 

as public safety communications; health information technology; 

smart grid, cyber physical, and industrial control systems; and programs focused on outreach 

to small businesses and federal agencies. The Division is home to several priority national 

programs including the National Cybersecurity Center of Excellence, the National Strategy for 

Trusted Identities in Cyberspace, and the National Initiative for Cybersecurity Education 

(NICE).

Ron Whitworth Ron Whitworth is Senior Vice President and Chief 

Privacy Officer at SunTrust in Atlanta, Georgia. He manages the 

Enterprise Privacy Office for SunTrust Banks, Inc. and all of its affiliates 

and subsidiaries. Ron is a Fellow of Information Privacy (FIP), Certified 

Information Privacy Manager (CIPM) and Certified Information Privacy 

Professional for the United States, Canada and Europe (CIPP/US, 

CIPP/C and CIPP/E). Prior to joining SunTrust, Ron served as Senior Vice 

President, Chief Privacy Officer and Associate General Counsel at 

EverBank in Jacksonville, FL. Earlier in his legal career, Ron was an 

attorney with Sullivan & Worcester, LLP, counseling clients on a wide variety of state, U.S., and 

international privacy and data security matters. He was also a member of S&W's 

Telecommunications Group, and worked closely with its Trademarks, Copyright & Licensing 

Group on matters involving online businesses. Before joining Sullivan & Worcester, Ron was a 

member of Commissioner Jonathan Adelstein’s staff at the FCC, and was an Associate with 

Fletcher, Heald & Hildreth, P.L.C. Ron also spent six years as editor-in-chief of Inside Wisconsin 

and Badger Nation Magazine and covered University of Wisconsin athletics for the Associated 

Press. He has appeared on dozens of local and national radio and television programs, 

including ESPN Radio and Fox Sports Radio. Ron is also a former associate producer for "The 

George Michael Sports Machine" and the NBC-4 Sports Department in Washington, D.C.