Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

This is the third in a series of public workshops on the development of the Privacy Framework: An Enterprise Risk Management 

Tool. This workshop provides an opportunity for attendees to actively engage in facilitated discussions to advance the 

development of the framework. NIST will use the working sessions at this workshop as input to validate or adjust the 

supplemental materials, to support the next stage of the process: releasing a preliminary draft framework.

Agenda: Day 1 (July 8)

Time Topic

7:30 AM Registration Opens

Jordan Ballroom Lobby, Boise State Student Union (2nd Floor)

1700 W University Dr., Boise, ID, 83725

8:30 AM Plenary Opening Remarks

Jordan D Ballroom

• Steven Feldstein, Frank and Bethine Church Chair of Public Affairs and associate professor, Boise State 

University

• Kevin Stine, Chief of the Applied Cybersecurity Division, NIST

8:45 AM Panel #1: Discussing the Privacy Framework with NIST

This panel will introduce the supplemental materials for the workshop. Engage with NIST leadership to learn more 

about the NIST Privacy Framework process and the approach taken in these materials.

Panelists:

• Donna Dodson, Chief Cybersecurity Advisor, NIST

• Naomi Lefkovitz, Senior Privacy Policy Advisor, NIST

• Adam Sedgewick, Senior IT Policy Advisor, NIST

• Kevin Stine, Chief of the Applied Cybersecurity Division, NIST

10:00 AM Break
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Time Topic

10:15 AM Panel #2: Getting to Implementation and Beyond

Hear from expert practitioners from various sectors about the implementation path for the NIST Privacy Framework. 

Panelists will discuss how their organizations are considering use of the framework with their current processes, the 

relationship between the framework and the development of a skilled and multilayered privacy workforce, and how 

the framework could be used to meet organizations’ needs across sectors and jurisdictions. Panelists will share their 

perspectives on additional framework improvements to increase usability and provide a foundation for further 

progress in privacy protection.

Moderator: Jamie Danker, Director of Privacy, Easy Dynamics, Corp.

Panelists:

• Caitlin Fennessy, Senior Privacy Fellow, International Association of Privacy Professionals

• Tim McIntyre, Associate General Counsel, Privacy & Product, Okta

• Dylan Gilbert, Policy Fellow, Public Knowledge

11:30 AM Rules of Engagement

11:45 AM

– 1:15 PM

Lunch 

On your own | Dining options available in the workshop vicinity.

1:15 PM –

2:45 PM

Working Session #1

Working sessions 1, 2, 3, and 6 will help NIST determine the path forward for the forthcoming Preliminary Draft of 

the Privacy Framework through an in-depth discussion of the supplemental materials:

• Proposed Integrated Core | PDF link

• Proposed Separated Core | PDF link

• Draft Executive Summary | PDF link

• For reference: Hypothetical Use Case Profiles | PDF link; Glossary | PDF link

See badge for assigned room.

2:45 PM Break

3:00 PM –

4:30 PM

Working Session #2

Continue discussions from working session #1. Return to same room as session #1.

4:30 PM Adjourn
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Agenda: Day 2 (July 9)

Time Topic

8:30 AM Working Session #3

Continue discussions from working session #2. Return to same room as session #2.

11:15 AM Break

11:30 AM 

– 12:30 PM

Working Session #4 (concurrent sessions)

Choose one of the following four topics. All topics will repeat in session 5.

Roadmap

Room: Hatch A

Emerging 

technologies, 

confidence 

mechanisms, and more 

– what are the 

challenges for privacy 

and the actions needed 

to address them? 

Discuss the Proposed 

Roadmap Topic Areas 

(PDF link) to help build 

a roadmap for the 

Privacy Framework.

Roles

Room: Jordan A

Would integrating 

workforce roles into the 

Privacy Framework 

improve organizational 

collaboration and make 

the Framework easier to 

use? How might those 

roles be categorized and 

assigned? This session 

will focus on who uses 

the Privacy Framework

and how to communicate 

this better.

Bridging Communication, 

Building Collaboration

Room: Jordan B

How do organizations create 

dialogue between disparate 

parts of the organization and 

broader ecosystem that speak 

different languages? This 

session will consider Profiles as 

a tool for bridging 

communication gaps and 

building collaboration, and 

how to best present the 

concept in the Privacy 

Framework.

Use Case Profiles | PDF link

Use Case Exercise

Room: Jordan C

Engage in a hypothetical 

use case exercise to stress 

test the NIST Privacy 

Framework.

12:30 PM -

1:45 PM

Lunch

On your own | Dining options available in the workshop vicinity.

1:45 PM –

2:45 PM

Working Session #5 (concurrent sessions)

Choose one of the following four topics. Note: These are repeated from session #4.
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Roadmap

Room: Hatch A

Roles

Room: Jordan A

Bridging Communication, 

Building Collaboration

Room: Jordan B

Use Case Exercise

Room: Jordan C

2:45 PM –

3:45 PM

Working Session #6

Continue discussions from working session #3. Return to same room as session #3.

3:45 PM Break

4:00 PM Recap

Jordan D Ballroom

Hear about the main takeaways from the workshop, directly from the working session facilitators.

Moderator: Adam Sedgewick, Senior IT Policy Advisor, NIST

Panelists:

• Matt Barrett, Chief Operating Officer, Cyber Engineering Services Inc.

• Rebecca Herold, Owner & CEO, Rebecca Herold & Associates, LLC

• Julie Snyder, Principal/Privacy Domain Capability Area Lead, The MITRE Corporation

• Nadya Bartol, Associate Director, Boston Consulting Group Platinion, Boston Consulting Group

4:20 PM Next Steps

• Naomi Lefkovitz, Senior Privacy Policy Advisor and Lead, Privacy Framework, NIST

• Ellen Nadeau, Deputy Manager, Privacy Framework, NIST

4:30 PM Adjourn
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Speaker Bios 

Matt Barrett Matt Barrett is Chief Operating Officer of Cyber Engineering Services Incorporated 

(CyberESI ) - a computer forensics and incident response provider. In this role, Mr. Barrett is 

responsible for all facets of operation, including service oversight, client communications, employee 

well-being, and corporate operations. Mr. Barrett previously led the Framework for Improving Critical 

Infrastructure Cybersecurity (aka Cybersecurity Framework) program for the National Institute of 

Standards and Technology (NIST). In support of this effort, Matt led a multi-stakeholder engagement

effort to develop and publish Cybersecurity Framework Version 1.1. Through his awareness campaign 

and efforts, Barrett propelled the Cybersecurity Framework to world-wide use, with a domestic usage 

that is estimated at over 30%. During his tenure at NIST, Matt also supported the Obama 

Administration’s Presidential Commission on Enhancing National Cybersecurity which provided fifty-three specific action items to 

protect cyberspace. Prior to NIST, Matt was President of G2, Inc. – a cybersecurity and signals intelligence engineering 

organization – and President of Trusted Security Alliance – an unpopulated joint venture in which G2 was the managing venturer.

Between 2009 and 2014, Matt grew G2 from 40 to 100 people.

Nadya Bartol Nadya Bartol is Associate Director and Cybersecurity Practice Leader at BCG 

Platinion, a division of Boston Consulting Group. Nadya has worked across multiple industry and 

government environments to advise organizations on improving their cybersecurity and cyber supply 

chain risk management programs. She has also advised technology companies on security 

organizational design. She is a globally recognized authority on cyber risk management, security 

measurement, cyber insurance, and third party risk and participated in or led the development of 

standards and guidelines on these topics including those by ISO and NIST.
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Jamie Danker Jamie Danker leads the Privacy Practice at Easy Dynamics Corp where she is 

responsible delivering Privacy Risk Management, Privacy Engineering, and Privacy Program 

Management services all aimed at helping clients build more trustworthy systems that protect

individuals from harm related to the collection, storage, and use of personally identifiable information. 

Prior to joining EDC, she spent 10 years at the Department of Homeland Security (DHS) in various roles 

in the DHS privacy enterprise advocating for building privacy into the earliest stages of system and 

program development including as Director, Senior Privacy Officer at the National Protection and 

Programs Directorate. She co-authored privacy requirements and considerations in the National 

Institute of Standards and Technology (NIST) Special Publication 800-63-3, Digital Identity Guidelines. 

Prior to joining DHS, Ms. Danker led and contributed to several audits concerning government-wide and agency-specific privacy 

issues at the US Government Accountability Office. 

Donna Dodson Donna Dodson is a pioneer and recognized leader in the U.S. Government’s 

efforts to address cybersecurity challenges. As NIST’s Chief Cybersecurity Advisor, Donna provides 

leadership and vision for all cybersecurity research programs at NIST. She is the primary technical 

expert and management advisor for cybersecurity for NIST and the Department of Commerce and is a 

key cybersecurity leader for the Administration and the Nation. Since joining NIST in 1987, Donna has 

been selected as a Fed 100 winner for innovations in cybersecurity, as one of the top 10 influential 

people in government IT in 2011, and as one of Fed Scoop’s Top 50 D.C. Women in Tech. 
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Steven Feldstein Steven Feldstein is the holder of the Frank and Bethine Church Chair of Public 

Affairs and an associate professor at Boise State University. He is also a nonresident fellow at the 

Carnegie Endowment for International Peace in the Democracy, Conflict and Governance Program. 

Previously, he served as a deputy assistant secretary in the bureau of democracy, human rights and 

labor at the U.S. Department of State, and the director of the office of policy at the U.S. Agency for 

International Development. He has also served as counsel on the U.S. Senate Foreign Relations 

Committee. His research interests include technology, democracy, human rights, U.S. foreign policy, 

and conflict trends. He is currently writing a book on the intersection of advanced technology, global 

repression and governance. His articles and commentary have appeared in Foreign Affairs, Journal of 

Democracy, Just Security, The National Interest, Salon, the Oxford Monitor of Forced Migration, Newsweek, World Politics 

Review, The Hill, and The Conversation. He received his B.A. from Princeton and his J.D. from Berkeley Law.

Caitlin Fennessy Caitlin Fennessy is a senior privacy fellow at the International Association of 

Privacy Professionals, where she leads the IAPP’s privacy engineering initiative and serves as an inhouse privacy expert. Prior to joining the IAPP, Caitlin was the Privacy Shield Director at the U.S. 

International Trade Administration. Caitlin joined ITA in 2009 and spent the next ten years working on 

international privacy and cross-border data flow policy issues. Caitlin served an adjunct professor of 

international privacy law at the University of Maine School of Law in 2016 and 2015 and at the 

University of New Hampshire School of Law in 2014. Before her time at ITA, Caitlin worked in the 

National Security Division of the Office of Management and Budget and with the U.S. Senate Foreign 

Relations Committee. Caitlin has a master’s degree in public affairs from Princeton University and a 

bachelor’s degree in social policy from Northwestern University. 
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Dylan Gilbert Dylan Gilbert is a Policy Fellow at Public Knowledge where he advocates for the 

public interest before the courts and policymakers with a focus on government affairs. His portfolio 

includes copyright reform, consumer privacy, and a variety of telecommunications issues. Prior to 

joining the Public Knowledge team, Dylan clerked at the National Telecommunications & Information 

Administration, the Federal Communications Commission, and America’s Public Television Stations. 

Dylan holds a J.D. from The George Washington University Law School and a B.A. cum laude from The 

College of William and Mary. In his free time, Dylan enjoys playing jazz piano and hitting errant golf 

shots at the driving range.

Rebecca Herold Rebecca is CEO of the consultancy Rebecca Herold, LLC, aka The Privacy 

Professor®, she founded in 2004. She is also Founder, in 2014, of SIMBUS, LLC Information Security, 

Privacy & Compliance cloud services. Rebecca has over 25 years of systems engineering, information 

security, privacy & compliance experience. Rebecca has authored 19 books to date, has contributed 

to dozens of other books, written hundreds of articles, and has received numerous awards, including 

being named a top female fighting cybercrime in the May, 2019 book Woman Know Cyber. Rebecca 

has keynoted on 5 continents to date and hopes to get to all 7. Rebecca led the U.S. National Institute 

of Standards & Technology (NIST) Smart Grid Privacy Subgroup for 7 years, where she co-authored 

privacy requirements and considerations in Volume 2: Privacy and the Smart Grid within NISTIR 7628 

and NISTIR 7628 Rev 1, Guidelines for Smart Grid Cybersecurity. Rebecca is currently a member of the NIST Privacy Framework 

development team. Rebecca was a co-founder/officer for IEEE P1912 Privacy and Security Architecture for Consumer Wireless 

Devices Working Group, and is on numerous advisory boards. Rebecca was Adjunct Professor for the Norwich University Master 

of Science in Information Security & Assurance program for 9 years. Rebecca is quoted in a large number of diverse publications, 

including the Wall Street Journal, Forbes, and dozens of others. Rebecca also serves as an information security, privacy and 

compliance expert witness for a wide range of cases. Rebecca holds degrees in Mathematics, Computer Science and Education. 

Rebecca earned the following certifications: CISM, CISA, FIP, CIPT, CIPM, CIPP/US, CISSP, FLMI, and is a Ponemon Institute 

Fellow. Rebecca is based in Des Moines, Iowa, USA.
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Naomi Lefkovitz Naomi Lefkovitz is the Senior Privacy Policy Advisor in the Information 

Technology Lab at the National Institute of Standards and Technology, U.S. Department of 

Commerce. She leads the privacy engineering program, which focuses on developing privacy risk 

management processes and integrating solutions for protecting individuals’ privacy into information 

technologies, including digital identity services, IoT, smart cities, big data, mobile, and artificial 

intelligence. She also leads the development team for the NIST Privacy Framework. 

FierceGovernmentIT named Ms. Lefkovitz on their 2013 “Fierce15” list of the most forward-thinking 

people working within government information technology, and she is a 2014 and 2018 Federal 100 

Awards winner. Before joining NIST, she was the Director for Privacy and Civil Liberties in the 

Cybersecurity Directorate of the National Security Council in the Executive Office of the President. Her portfolio included the 

National Strategy for Trusted Identities in Cyberspace as well as addressing the privacy and civil liberties impact of the Obama 

Administration’s cybersecurity initiatives and programs. Prior to her tenure in the Obama Administration, Ms. Lefkovitz was a

senior attorney with the Division of Privacy and Identity Protection at the Federal Trade Commission. Her responsibilities focused 

primarily on policy matters, including legislation, rulemakings, and business and consumer education in the areas of identity

theft, data security and privacy. At the outset of her career, she was Assistant General Counsel at CDnow, Inc., an early online 

music retailer. Ms. Lefkovitz holds a B.A. with honors in French Literature from Bryn Mawr College and a J.D. with honors from 

Temple University School of Law. 

Ellen Nadeau Ellen Nadeau is part of the Privacy Engineering Program at NIST, where she works 

to develop and pilot privacy risk management guidance and tools for organizations across sectors. 

She specializes in privacy-enhancing identity management solutions. Ellen received her Master’s of 

Public Administration from New York University, where she was a Scholar for Service at the NYU 

Center for Interdisciplinary Studies in Security and Privacy. Previously, Ellen worked at a digital rights 

nonprofit (Derechos Digitales) in Santiago, Chile, as a Google Policy Fellow, and with the National 

Center for Missing & Exploited Children in the Netsmartz Workshop.
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Adam Sedgewick Adam Sedgewick serves as Senior IT Policy Advisor at the NIST. In this role, 

he advises NIST and Department of Commerce leadership on cybersecurity and technology policy 

issues. In 2017, he served as Technology Policy Advisor in the Commerce Department’s Office of 

Policy and Strategic Planning. Previously, he was Senior Advisor to the Federal CIO Council. 

Sedgewick served as Professional Staff Member for the Senate Committee on Homeland Security and 

Governmental Affairs for nine years, handling cybersecurity and federal IT policy. He has twice 

received the Fed 100 award for his contributions to the Federal IT community and both 

BankInfoSecurity and GovInfoSecurity named him a “Top Ten Influencer.” In 2014 he was named one 

of Security Magazine’s Most Influential People in Security for 2014. 

Julie Snyder Julie Snyder is a Principal and the Privacy Domain Capability Area Lead for the 

MITRE National Cybersecurity Federally Funded Research and Development Center (“NCF”). Prior to 

working in the NCF, Julie was part of the privacy engineering capability in MITRE’s Cybersecurity 

Technical Center. She has worked with multiple defense, IC, and civilian agencies on cybersecurity 

and privacy risk management activities, focusing in recent years on privacy engineering and 

Cybersecurity Framework implementation in both government and critical infrastructure industries. 

She also recently supported the Government of Japan with a cybersecurity strategic risk assessment 

program for the Tokyo 2020 Olympics. Julie has supported development of government security and 

privacy standards, including NIST SP 800-37, Rev 2, the anticipated SP 800-53, Rev 5, and NIST SP 

800-150, as well as the Committee on National Security Standards (CNSS) instruction for protecting personally identifiable 

information (PII) in information systems (CNSSI No. 1253 Privacy Overlays). Prior to joining MITRE, she was a Manager at PwC

where she supported various industries with improving their cybersecurity programs and later led the Federal Privacy Practice. 

Julie earned her BBA in Information and Operations Management (MIS) from Texas A&M University and holds the CIPM, CIPP/G, 

CIPP/US, and CIPT certifications.
Agenda for Getting to V1.0 of the NIST Privacy Framework: Workshop #3

BOISE STATE UNIVERSITY | JULY 8-9, 2019

Kevin Stine Mr. Kevin Stine is the Chief of the Applied Cybersecurity Division in the 

National Institute of Standards and Technology’s Information Technology Laboratory. In this 

capacity, he leads NIST collaborations with industry, academia, and government to improve

cybersecurity and privacy risk management through the effective application of standards, best 

practices, and technologies. The Applied Cybersecurity Division develops cybersecurity and 

privacy guidelines, tools, and reference architectures in diverse areas such as public safety 

communications; health information technology; smart grid, cyber physical, and industrial 

control systems; and programs focused on outreach to small businesses and federal agencies. 

The Division is home to several priority programs including the Cybersecurity Framework, Cybersecurity for IoT, the 

National Cybersecurity Center of Excellence, Identity and Access Management, Privacy Engineering and the National 

Initiative for Cybersecurity Education.