Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

1

List of Standards and Guidance Cited in NIST Privacy Framework Request for Information Responses

This document provides a list of standards, guidance, or similar documents cited in responses to the NIST Privacy Framework Request for Information (RFI).1,2

Some cited documents may be in draft form.

Document Title Name Source URL (if available) Type

A Guide to Data Governance for Privacy, 

Confidentiality and Compliance

Microsoft https://iapp.org/resources/article/a-guide-to-data-governancefor-privacy-confidentiality-and-compliance/report

A Taxonomy of Privacy Daniel J. Solove https://www.law.upenn.edu/journals/lawreview/articles/volume

154/issue3/Solove154U.Pa.L.Rev.477(2006).pdf

report

A Visual Guide to Practical Data DeIdentificationFuture of Privacy 

Forum

https://fpf.org/2016/04/25/a-visual-guide-to-practical-data-deidentification/guidance/best 

practices

AICPA/CICA Privacy Maturity Model American Institute of 

Certified Public 

Accountants (AICPA) 

https://iapp.org/media/pdf/resource_center/aicpa_cica_privacy_

maturity_model_final-2011.pdf

maturity model

AMA Code of Medical Ethics American Medical 

Association (AMA)

https://www.ama-assn.org/sites/ama-assn.org/files/corp/mediabrowser/principles-of-medical-ethics.pdfguidance/best 

practices

APEC Privacy Framework Asia-Pacific Economic 

Cooperation (APEC) 

https://www.apec.org/Publications/2005/12/APEC-PrivacyFrameworkframework

Big Data and Privacy: A Technological 

Perspective

Executive Office of the 

President, President’s 

Council of Advisors on 

Science and 

Technology

https://obamawhitehouse.archives.gov/sites/default/files/micros

ites/ostp/PCAST/pcast_big_data_and_privacy_-_may_2014.pdf

report

BSA Privacy Framework BSA | The Software 

Alliance

https://www.bsa.org/~/media/Files/Policy/BSA_2018_PrivacyFra

mework.pdf

framework

CNIL Privacy Impact Assessment National Commission 

on Informatics and 

Liberty (CNIL) 

https://www.cnil.fr/en/privacy-impact-assessment-pia tool

 

1 Federal Register Notice 83 FR 56824, Developing a Privacy Framework, https://www.federalregister.gov/documents/2018/11/14/2018-24714 /developing-a-privacyframework; Notice of Extension: Federal Register Notice 83 FR 64531, Developing a Privacy Framework, https://www.federalregister.gov/documents/2018/12/17/2018-

27248/developing-a-privacy-framework.

2 The responses are posted at: https://www.nist.gov/privacy-framework/request-information. As stated in the RFI, responses that contained “profanity, vulgarity, threats, or 

other inappropriate language or content” were not posted or considered.
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

2

Document Title Name Source URL (if available) Type

Consent Receipt Specification Kantara Initiative https://kantarainitiative.org/confluence/display/infosharing/Cons

ent+Receipt+Specification

protocol/specification

Consolidated Clinical Document 

Architecture

DICOM Standards 

Committee

https://searchhealthit.techtarget.com/definition/ClinicalDocument-Architecture-CDAtool

Cybersecurity Assessment Tool Federal Financial 

Institutions 

Examination Council 

(FFIEC)

https://www.ffiec.gov/cyberassessmenttool.htm tool

Data Ethics Framework UK Department for 

Digital, Culture, Media 

& Sport (DCMS)

https://www.gov.uk/government/publications/data-ethicsframeworkframework

Deceived by Design: How Tech 

Companies Use Dark Patterns to 

Discourage Us from Exercising Our Rights 

to Privacy

Norwegian Consumer 

Council

https://fil.forbrukerradet.no/wp-content/uploads/2018/06/2018-

06-27-deceived-by-design-final.pdf

report

DICOM PS3.15 2019a - Security and 

System Management Profiles (Part 15, 

Chapter E)

National Electrical 

Manufacturers 

Association (NEMA)

http://dicom.nema.org/medical/dicom/current/output/html/part

15.html#chapter_E

tool

Exploratory Study of the Privacy 

Extension for System Theoretic Process 

Analysis (STPA-Priv) to Elicit Privacy Risks 

in eHealth 

IEEE Standards 

Association (IEEE)

https://ieeexplore.ieee.org/document/8054835 methodology

Factor Analysis of Information Risk (FAIR) 

FAIR Institute 

FAIR Institute https://www.fairinstitute.org/what-is-fair framework framework

Fast Healthcare Interoperability 

Resources (FHIR) AuditEvent Resource

Health Level Seven® 

International (HL7)

http://build.fhir.org/auditevent.html guidance/best 

practices

Fast Healthcare Interoperability 

Resources (FHIR) Consent Resource

HL7 http://build.fhir.org/consent.html guidance/best 

practices

Fast Healthcare Interoperability 

Resources (FHIR) Contract Resource

HL7 http://build.fhir.org/contract.html guidance/best 

practices

Fast Healthcare Interoperability 

Resources (FHIR) Provenance Resource

HL7 http://build.fhir.org/provenance.html guidance/best 

practices
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

3

Document Title Name Source URL (if available) Type

Fast Healthcare Interoperability 

Resources (FHIR) Security and Privacy 

Module

HL7 http://build.fhir.org/secpriv-module.html standard

Fast Healthcare Interoperability 

Resources (FHIR) SMART Application 

Launch Framework Implementation 

Guide Release 1.0.0 

HL7 http://hl7.org/fhir/smart-app-launch/scopes-and-launchcontext/index.htmlguidance/best 

practices

Federal Information Processing Standards 

(FIPS)

National Institute of 

Standards and 

Technology (NIST)

https://www.nist.gov/itl/current-fips standard

Framework for Improving Critical 

Infrastructure Cybersecurity

NIST https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.p

df

framework

Framework to Advance Interoperable 

Rules (FAIR) on Privacy

Information 

Technology Industry 

Council

https://www.itic.org/publicpolicy/FINALFrameworktoAdvanceInteroperableRules%28FAIR%2

9onPrivacyFinal_NoWatermark.pdf

framework

Generally Accepted Privacy Principles 

(GAPP)

AICPA https://www.cpacanada.ca/-/media/site/operational/msmember-services/docs/00250-generally-accepted-privacyprinciples.pdfprinciples

HITRUST CSF® HITRUST Alliance https://hitrustalliance.net/hitrust-csf/ framework

HL7 - Cookbook for Security 

Considerations

HL7 http://wiki.hl7.org/index.php?title=Cookbook_for_Security_Consi

derations

guidance/best 

practices

HL7 - EHR Functional Model, Release 1 HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=18

Model

HL7 CDA® R2 Implementation Guide: 

Patient-Friendly Language for Consumer 

User-Interfaces, Release 1

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=412

standard

HL7 CDA® R2 Implementation Guide: 

Privacy Consent Directives, Release 1

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=280

standard

HL7 Healthcare Privacy and Security 

Classification System (HCS), Release 1

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=345

standard

HL7 Implementation Guide: Data 

Segmentation for Privacy (DS4P), Release 

1

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=354

standard

HL7 Provenance Conceptual Model HL7 framework
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

4

Document Title Name Source URL (if available) Type

HL7 Standards Privacy Assessment 

Project

HL7 http://wiki.hl7.org/index.php?title=HL7_Standards_Privacy_Asses

sment_Project

tool

HL7 Standards Privacy Impact 

Assessment (SPIA) Cookbook

HL7 http://wiki.hl7.org/index.php?title=HL7_SPIA_Cookbook_Project methodology

HL7 Trust Framework for Federated 

Authorization Conceptual and Behavioral 

Models 

HL7 http://www.hl7.org/special/Committees/projman/searchableProj

ectIndex.cfm?action=edit&ProjectNumber=914

framework

HL7 Version 2.x (V2) Messaging Standard HL7 https://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=185

standard

HL7 Version 3 Domain Analysis Model: 

Medical Records; Composite Privacy 

Consent Directive

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=74

standard

HL7 Version 3 Standard: Healthcare 

(Security and Privacy) Access Control 

Catalog, Release 3

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=72

standard

HL7 Version 3 Standard: Healthcare 

(Security and Privacy) Role-Based Access 

Control Catalog, Release 3

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=72

standard

HL7 Version 3 Standard: Privacy, Access 

and Security Services; Security Labeling 

Service, Release 1 

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=360

standard

HL7 Version 3 Standard: Security and 

Privacy Ontology, Release 1 

HL7 http://www.hl7.org/implement/standards/product_brief.cfm?pr

oduct_id=348

standard

IA Privacy Principles For A Modern 

National Regulatory Framework

Internet Association https://internetassociation.org/wpcontent/uploads/2018/09/IA_Privacy-Principles-For-A-ModernNational-Regulatory-Framework_full-doc.pdfprinciples

Identity Ecosystem Framework The Identity 

Ecosystem Steering 

Group (IDESG)

https://idesg.edufoundation.kantarainitiative.org/The-IDEcosystem/Identity-Ecosystem-Framework/Development-of-theIDEF.htmlframework

Identity Ecosystem Framework Baseline 

Functional Requirements v1.0

IDESG https://idesg.edufoundation.kantarainitiative.org/portals/0/docu

ments/core/IDEF-Baseline-Requirements-v1.0-FINAL10152015_MOD-4.pdf

framework
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

5

Document Title Name Source URL (if available) Type

Identity Management Recommendations International 

Telecommunications 

Union (ITU) Identity 

Management (IDM) 

https://www.itu.int/en/ITUT/studygroups/com17/Pages/idm.aspxguidance/best 

practices

IEC 60839-11-5 ED1 Alarm and electronic 

security systems - Part 11-5: Electronic 

access control systems - Open Supervised 

Device Protocol (OSDP)

International 

Electrotechnical 

Commission (IEC)

https://www.iec.ch/dyn/www/f?p=103:38:4892262727330::::FSP

_ORG_ID,FSP_APEX_PAGE,FSP_PROJECT_ID:1269,23,23397

standard

IHE IT Infrastructure Handbook: DeIdentificationIntegrating the Health 

Enterprise (IHE) IT 

Infrastructure 

Technical Committee 

http://ihe.net/uploadedFiles/Documents/ITI/IHE_ITI_Handbook_

De-Identification_Rev1.0_2014-03-14.pdf

guidance/best 

practices

In the Picture: A Data Protection Code of 

Practice for Surveillance Cameras and 

Personal Information

Information 

Commissioner’s Office 

(ICO)

https://ico.org.uk/media/1542/cctv-code-of-practice.pdf guidance/best 

practices

Information Technology Sector Baseline 

Risk Assessment

U.S. Department of 

Homeland Security 

(DHS)

https://www.dhs.gov/xlibrary/assets/nipp_it_baseline_risk_asses

sment.pdf

tool

Internet of Things (IoT) Privacy & Security 

in a Connected World

Federal Trade 

Commission (FTC)

https://www.ftc.gov/system/files/documents/reports/federaltrade-commission-staff-report-november-2013-workshopentitled-internet-things-privacy/150127iotrpt.pdfreport

ISAO SP 4000: Protecting Consumer 

Privacy in Cybersecurity Information 

Sharing V1.0

Information Sharing 

and Analysis 

Organization 

Standards 

Organization (ISAO 

SO)

https://www.isao.org/products/isao-sp-4000-protectingconsumer-privacy-in-cybersecurity-information-sharing-v1-0/standard

ISO 25237:2017 Health informatics --

Pseudonymization

International 

Organization for 

Standardization (ISO)

https://www.iso.org/standard/63553.html standard

ISO 31000:2018 Risk management --

Guidelines

ISO https://www.iso.org/standard/65694.html standard
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

6

Document Title Name Source URL (if available) Type

ISO/IEC 19086-4:2019 Cloud computing --

Service level agreement (SLA) framework 

-- Part 4: Components of security and of 

protection of PII

ISO/IEC https://www.iso.org/standard/68242.html standard

ISO/IEC 19941:2017 Information 

technology -- Cloud computing --

Interoperability and portability

ISO/IEC https://www.iso.org/standard/66639.html standard

ISO/IEC 19944:2017 Information 

technology -- Cloud computing -- Cloud 

services and devices: Data flow, data 

categories and data use

ISO/IEC https://www.iso.org/standard/66674.html standard

ISO/IEC 20889:2018 Privacy enhancing 

data de-identification terminology and 

classification of techniques

ISO/IEC https://www.iso.org/standard/69373.html standard

ISO/IEC 24744:2014 Software engineering 

-- Metamodel for development 

methodologies

ISO/IEC https://www.iso.org/standard/62644.html standard

ISO/IEC 27000:2018 Information 

technology -- Security techniques --

Information security management 

systems -- Overview and vocabulary

ISO/IEC https://www.iso.org/standard/73906.html standard

ISO/IEC 27001:2013 Information 

technology -- Security techniques --

Information security management 

systems -- Requirements

ISO/IEC https://www.iso.org/standard/54534.html standard

ISO/IEC 27002:2013 Information 

technology -- Security techniques -- Code 

of practice for information security 

controls

ISO/IEC https://www.iso.org/standard/54533.html standard

ISO/IEC 27017:2015 Information 

technology -- Security techniques -- Code 

of practice for information security 

controls based on ISO/IEC 27002 for 

cloud services

ISO/IEC https://www.iso.org/standard/43757.html standard
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

7

Document Title Name Source URL (if available) Type

ISO/IEC 27018:2019 Information 

technology -- Security techniques -- Code 

of practice for protection of personally 

identifiable information (PII) in public 

clouds acting as PII processors

ISO/IEC https://www.iso.org/standard/76559.html standard

ISO/IEC 29100:2011 Information 

technology -- Security techniques --

Privacy framework

ISO/IEC https://www.iso.org/standard/45123.html standard

ISO/IEC 29101:2018 Information 

technology -- Security techniques --

Privacy architecture framework

ISO/IEC https://www.iso.org/standard/75293.html standard

ISO/IEC CD 29184 Information technology 

-- Online privacy notices and consent

ISO/IEC https://www.iso.org/standard/70331.html standard

ISO/IEC DIS 27552 Security techniques --

Extension to ISO/IEC 27001 and ISO/IEC 

27002 for privacy information 

management -- Requirements and 

guidelines

ISO/IEC https://www.iso.org/standard/71670.html standard

ISO/PC 317

Consumer protection: privacy by design 

for consumer goods and services 

ISO Project 

Committee (PC)

https://www.iso.org/committee/6935430.html standard

Kantara Identity Assurance Framework 

(IAF)

Kantara Initiative https://kantarainitiative.org/confluence/display/LC/Identity+Assu

rance+Framework

framework

MITRE Privacy Engineering Framework MITRE https://www.mitre.org/publications/technical-papers/privacyengineering-frameworkframework

Mozilla’s "Privacy Not Included" Mozilla https://foundation.mozilla.org/en/privacynotincluded/ consumer guidance

NARUC Federalism Task Force Report: 

Cooperative Federalism and Telecom In 

the 21st Century

National Association 

of Regulatory Utility 

Commissioners 

(NARUC)

https://pubs.naruc.org/pub.cfm?id=0D53064E-9E9C-0929-9D01-

FDBF631704F5

report

Green Paper: Fostering the Advancement 

of the Internet of Things

National 

Telecommunications 

and Information 

Administration (NTIA)

https://www.ntia.doc.gov/other-publication/2017/green-paperfostering-advancement-internet-thingsreport
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

8

Document Title Name Source URL (if available) Type

Network Advertising Initiative's Code of 

Conduct

Network Advertising 

Initiative 

https://www.networkadvertising.org/sites/default/files/nai_code

2018.pdf

guidance/best 

practices

NIST SP 800-115, Technical Guide to 

Information Security Testing and 

Assessment

NIST https://csrc.nist.gov/publications/detail/sp/800-115/final guidance/best 

practices

NIST SP 800-162, Guide to Attribute 

Based Access Control (ABAC) Definition 

and Considerations

NIST https://csrc.nist.gov/publications/detail/sp/800-162/final guidance/best 

practices

NIST SP 800-171 Rev. 1, Protecting 

Controlled Unclassified Information in 

Nonfederal Systems and Organizations

NIST https://csrc.nist.gov/publications/detail/sp/800-171/rev-1/final guidance/best 

practices

NIST SP 800-37 Rev. 2, Risk Management 

Framework for Information Systems and 

Organizations: A System Life Cycle 

Approach for Security and Privacy

NIST https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final guidance/best 

practices

NIST SP 800-37 Rev. 2, Risk Management 

Framework for Information Systems and 

Organizations: A System Life Cycle 

Approach for Security and Privacy (Initial 

Public Draft)

NIST https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final guidance/best 

practices

NIST SP 800-53 Rev. 5 (DRAFT), Security 

and Privacy Controls for Information 

Systems and Organizations

NIST https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/draft guidance/best 

practices

NIST SP 800-63-3, Digital Identity 

Guidelines

NIST https://csrc.nist.gov/publications/detail/sp/800-63/3/final guidance/best 

practices

NISTIR 8053, De-Identification of Personal 

Information

NIST https://csrc.nist.gov/publications/detail/nistir/8053/final guidance/best 

practices

NISTIR 8062, An Introduction to Privacy 

Engineering and Risk Management in 

Federal Systems

NIST https://csrc.nist.gov/publications/detail/nistir/8062/final guidance/best 

practices

NISTIR 8074 Vol. 1, Interagency Report on 

Strategic U.S. Government Engagement 

in International Standardization to 

Achieve U.S. Objectives for Cybersecurity

NIST https://csrc.nist.gov/publications/detail/nistir/8074/vol-1/final guidance/best 

practices
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

9

Document Title Name Source URL (if available) Type

NISTIR 8074 Vol. 2, Supplemental 

Information for the Interagency Report 

on Strategic U.S. Government 

Engagement in International 

Standardization to Achieve U.S. 

Objectives for Cybersecurity

NIST https://csrc.nist.gov/publications/detail/nistir/8074/vol-2/final guidance/best 

practices

NISTIR 8228 (DRAFT), Considerations for 

Managing Internet of Things (IoT) 

Cybersecurity and Privacy Risks

NIST https://csrc.nist.gov/publications/detail/nistir/8228/draft guidance/best 

practices

Novel ISO/IEEE 11073 Standards for 

Personal Telehealth Systems 

Interoperability

IEEE https://ieeexplore.ieee.org/document/4438177 standard

Nymity Privacy Management 

Accountability FrameworkTM for

Identifying and Mitigating Risk

Nymity https://info.nymity.com/privacy-management-accountabilityframeworkframework

Nymity Processing Purposes Risk 

Framework

Nymity framework

Open Supervised Device Protocol (OSDP) Security Industry 

Association (SIA) 

https://www.securityindustry.org/industry-standards/opensupervised-device-protocol/protocol/specification

Open Web Application Security Project 

(OWASP) Top Ten Critical Web 

Application Security Risks

Open Web Application 

Security Project 

(OWASP) 

https://www.owasp.org/index.php/Category:OWASP_Top_Ten_P

roject

report

Organisation for Economic Co-operation 

and Development (OECD) Guidelines on 

the Protection of Privacy and Transborder 

Flows of Personal Data

Organisation for 

Economic Cooperation and 

Development (OECD)

https://www.oecd.org/internet/ieconomy/oecdguidelinesonthep

rotectionofprivacyandtransborderflowsofpersonaldata.htm

guidance/best 

practices

Organisation for Economic Co-operation 

and Development (OECD) Privacy 

Principles

OECD http://oecdprivacy.org/ principles

Organisation for Economic Co-operation 

and Development (OECD)Privacy 

Framework

OECD https://www.oecd.org/sti/ieconomy/oecd_privacy_framework.p

df

framework
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

10

Document Title Name Source URL (if available) Type

Organization for the Advancement of

Structured Information Standards (OASIS) 

Privacy by Design Documentation for 

Software Engineers (PbD-SE)

Organization for the 

Advancement of 

Structured 

Information Standards 

(OASIS)

https://www.oasisopen.org/committees/tc_home.php?wg_abbrev=pbd-sestandard

Organization for the Advancement of 

Structured Information Standards (OASIS) 

Privacy Management Reference Model 

(PMRM)

OASIS https://www.oasis-open.org/committees/pmrm/ standard

P1912 - Standard for Privacy and Security 

Architecture for Consumer Wireless 

Devices

IEEE https://standards.ieee.org/project/1912.html standard

P1912 - Standard for Privacy and Security 

Architecture for Consumer Wireless 

Devices

IEEE https://standards.ieee.org/project/1912.html standard

P2025.2 - Standard for Consumer Drones: 

Privacy and Security

IEEE https://standards.ieee.org/project/2025_2.html standard

P2413 Standard for an Architectural 

Framework for the Internet of Things

IEEE http://sites.ieee.org/icps-ehe/files/2018/11/IEEE-P2413-

Standard-for-an-Architectural-Framework-for-the-Internet-ofThings.pdf

standard

P2418.1 - Standard for the Framework of 

Blockchain Use in Internet of Things (IoT)

IEEE https://standards.ieee.org/project/2418_1.html standard

P2418.2 - Standard Data Format for 

Blockchain Systems

IEEE https://standards.ieee.org/project/2418_2.html standard

P2418.3 - Standard for the Framework of 

Distributed Ledger Technology (DLT) Use 

in Agriculture

IEEE https://standards.ieee.org/project/2418_3.html standard

P2418.4 - Standard for the Framework of 

Distributed Ledger Technology (DLT) Use 

in Connected and Autonomous Vehicles 

(CAVs)

IEEE https://standards.ieee.org/project/2418_4.html standard

P2418.5 - Standard for Blockchain in 

Energy

IEEE https://standards.ieee.org/project/2418_5.html standard
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

11

Document Title Name Source URL (if available) Type

P2418.6 - Standard for the Framework of 

Distributed Ledger Technology (DLT) Use 

in Healthcare and the Life and Social 

Sciences

IEEE https://standards.ieee.org/project/2418_6.html standard

P2418.7 - Standard for the Use of 

Blockchain in Supply Chain Finance

IEEE https://standards.ieee.org/project/2418_7.html standard

P2801 - Recommended Practice for the 

Quality Management of Datasets for 

Medical Artificial Intelligence

IEEE https://standards.ieee.org/project/2801.html standard

P7002 - Data Privacy Process IEEE https://standards.ieee.org/project/7002.html standard

P7004 - Standard for Child and Student 

Data Governance

IEEE https://standards.ieee.org/project/7004.html standard

P7005 - Standard for Transparent 

Employer Data Governance

IEEE https://standards.ieee.org/project/7005.html standard

P7006 - Standard for Personal Data 

Artificial Intelligence (AI) Agent

IEEE https://standards.ieee.org/project/7006.html standard

P7012 - Standard for Machine Readable 

Personal Privacy Terms

IEEE https://standards.ieee.org/project/7012.html standard

P802E - Recommended Practice for 

Privacy Considerations for IEEE 802 

Technologies

IEEE https://standards.ieee.org/project/802E.html standard

Payment Card Industry Data Security 

Standard (PCI DSS)

Payment Card 

Industry Security 

Standards Council

https://www.pcisecuritystandards.org/pci_security/ standard

PbD-SE Conformance Maturity Model 

(PbD-CMM)

OASIS https://www.oasisopen.org/committees/download.php/55849/pbd-se-v1_0-

wd07.docx

maturity model

PReparing Industry to Privacy-by-design 

by supporting its Application in REsearch 

(PRIPARE) Handbook: Methodological 

Tools to Implement Privacy and Foster 

Compliance with the GDPR

PReparing Industry 

to Privacy-by-design 

by supporting 

its Application 

in REsearch

http://pripareproject.eu/ tool

Privacy and Biometrics: Building a 

Conceptual Foundation

National Science and 

Technology Council 

(NSTC) 

https://www.hsdl.org/?view&did=463913 guidance/best 

practices
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

12

Document Title Name Source URL (if available) Type

Privacy by Design Documentation for 

Software Engineers

Organization for the 

Advancement of 

Structured 

Information Standards 

(OASIS)

https://www.oasisopen.org/committees/tc_home.php?wg_abbrev=pbd-seprotocol/specification

Privacy in Context: Technology, Policy, 

and the Integrity of Social Life

Helen Nissenbaum https://crypto.stanford.edu/portia/papers/RevnissenbaumDTP31

.pdf

book

Privacy Management Programme: A Best 

Practice Guide

Privacy Commissioner 

for Personal Data, 

Hong Kong

https://www.pcpd.org.hk/pmp/files/pmp_guide2018.pdf guidance/best 

practices

Privacy Online: Fair Information Practices 

in the Electronic Marketplace: A Federal 

Trade Commission Report to Congress

FTC https://www.ftc.gov/reports/privacy-online-fair-informationpractices-electronic-marketplace-federal-trade-commissionprinciples

Privacy Policy Guidance Memorandum, 

The Fair Information Practice Principles: 

Framework for Privacy Policy at the 

Department of Homeland Security 

DHS https://www.dhs.gov/sites/default/files/publications/privacy_pol

icyguide_2008-01_0.pdf

principles

Protecting Consumer Privacy in an Era of 

Rapid Change, Recommendations for 

Businesses and Policymakers

FTC https://www.ftc.gov/sites/default/files/documents/reports/feder

al-trade-commission-report-protecting-consumer-privacy-erarapid-change-recommendations/120326privacyreport.pdf

report

Protecting Consumer Privacy in an Era of 

Rapid Change: Recommendations For 

Businesses and Policymakers

FTC https://www.ftc.gov/reports/protecting-consumer-privacy-erarapid-change-recommendations-businesses-policymakersreport

Security Industry Association (SIA) 

Privacy Framework

Security Industry 

Association (SIA) 

https://www.securityindustry.org/wpcontent/uploads/2017/11/gr-privacy-framework.pdfframework

Situating Anonymization Within a Privacy 

Risk Model

Homeland Security 

Systems Engineering 

and Development 

Institute, operated by 

the MITRE 

Corporation

https://www.mitre.org/sites/default/files/pdf/12_0353.pdf report

Six Principles to Guide Microsoft’s Facial 

Recognition Work

Microsoft https://blogs.microsoft.com/on-the-issues/2018/12/17/sixprinciples-to-guide-microsofts-facial-recognition-workprinciples
Standards and Guidance Cited in NIST Privacy Framework RFI Responses February 27, 2019

13

Document Title Name Source URL (if available) Type

Structured Assurance Case Metamodel 

(SACM) Specification, Version 2.0

Object Management 

Group (OMG)

https://www.omg.org/spec/SACM/About-SACM/ protocol/specification

System and Organization Controls (SOC) 1 

Report

AICPA report

System and Organization Controls (SOC) 2 

Report

AICPA report

The Digital Standard The Digital Standard https://www.thedigitalstandard.org/ standard

The New Codes of Conduct: Guiding 

Principles for the Ethical Use of Data

Acxiom https://marketing.acxiom.com/US-Parent-Guiding-Principles-forthe-Ethical-Use-of-Data-EB-Main.htmlguidance/best 

practices

The Role of Risk Management in Data 

Protection 

Centre for Information 

Policy Leadership

https://www.informationpolicycentre.com/uploads/5/7/1/0/571

04281/white_paper_2-

the_role_of_risk_management_in_data_protection-c.pdf

report

The White House, Consumer Data Privacy 

in a Networked World: A Framework for 

Protecting Privacy and Promoting 

Innovation in the Global Digital Economy

The White House, 

Consumer Data 

Privacy in a 

Networked World

https://obamawhitehouse.archives.gov/sites/default/files/privac

y-final.pdf

report

Transparency & Consent Framework IAB Europe https://advertisingconsent.eu/ framework