Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/collaboration-space/focus-areas/risk-assessment/tools

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology LaboratoryApplied Cybersecurity Division

## Privacy Engineering Program

-  About  Expand or Collapse    -  Meet the Team 
-  Collaboration Space  Expand or Collapse    -  Operating Rules  Expand or Collapse      -  Moderators 
  -  Contribute to Focus Areas  Expand or Collapse      -  Contribution Instructions 
  -  Disassociability  Expand or Collapse      -  Tools 
    -  Use Cases 
  -  Privacy Risk Assessment  Expand or Collapse      -  Tools 
    -  Use Cases 
  -  Challenges  Expand or Collapse      -  Collaborative Challenges 
    -  Prize Challenges 
  -  Blog Series  Expand or Collapse      -  Differential Privacy 
    -  Privacy-Preserving Federated Learning 
-  Resources 
-  Events 
-  Get Involved 

## Connect with us

TwitterGovDelivery

# Risk Assessment Tools

## Share

Facebook

Linkedin

Twitter

Email

Return to Risk Assessment

----

### Privado Scan

Privado Scan is an open-source privacy scanner that allows an engineer to scan their application code and discover how data flows in the application. It detects hundreds of personal data elements being processed and further maps the data flow from the point of collection to "sinks" such as external third parties, databases, logs, and internal APIs. It allows privacy engineers to concretely verify and assess if a certain data collection policy set on an application actually matches the implementation right in the code itself - thus embedding privacy assessments in the developers' workflow.

**Additional Info:** Here are some resources to learn how Privado Scan works and how to contribute to it:
                  - Source:  Rules ,  Engine
                  - Docs:  https://docs.privado.ai
                  - Use Cases:	                     - Generate and maintain data maps and Record of Processing Activity (RoPA) Reports by scanning code
                    - Discover and classify personal data elements inside the application's code and verify if they adhere to privacy policies
                    - Get comprehensive insight on dataflows within an application from interesting sources (such as user input forms) to interesting sinks (such as logs, external services, third parties, databases etc.)
                    - Verify and enforce data protection and governance policies right in code
                    - Assess private data leakage risks by directly verifying it at an engineering level (eg. verify if a developer collected precise location in a phone app and if it was actualy sent to a remote third party logging service)
                  - Talks/Videos:  Building an Automated Machine for Discovering Privacy Violations at Scale (Usenix Enigma 2023)  [Link]

Feedback and suggestions for improvement of Privado Scan are welcome. Please reach out to Privado on the Privado Slack Community.

**Affiliation/Organization(s) Contributing:** Privado Inc. **GitHub POC:**@tuxology

Privado Scan on GitHubShare Feedback

----

### FAIR Privacy

FAIR Privacy is a quantitative privacy risk framework based on FAIR (Factors Analysis in Information Risk). FAIR Privacy examines personal privacy risks (to individuals), not organizational risks. Included in this tool is a PowerPoint deck illustrating the components of FAIR Privacy and an example based on a hypothetical smart lock manufacturer. In addition, an Excel spreadsheet provides a powerful risk calculator using Monte Carlo simulation.

**Notes:***V2.11 March 2022 Update:*A revised version of the PowerPoint deck and calculator are provided based on the example used in the paper "Quantitative Privacy Risk" presented at the 2021 International Workshop on Privacy Engineering (https://ieeexplore.ieee.org/document/9583709). The newer Excel based calculator:
                  - uses a Poisson distribution for threat opportunity (previously Beta-PERT)
                  - uses Binomial distribution for Attempt Frequency and Violation Frequency (Note: inherent baseline risk assumes 100% vulnerability)
                  - provides a method of calculating organizational risk tolerance
                  - provides a second risk calculator for comparison between two risks for help prioritizing efforts
                  - provides a tab for comparing inherent/baseline risk to residual risk, risk tolerance and the other risk tab
                  - increased instructional text
                  - genericization of privacy harm and adverse tangible consequences

Some additional resources are provided in the PowerPoint deck. Feedback and suggestions for improvement on both the framework and the included calculator are welcome. Additionally, analysis of the spreadsheet by a statistician is most welcome.

**Affiliation/Organization(s) Contributing:** Enterprivacy Consulting Group**GitHub POC:**@privacymaverick

FAIR Privacy on GitHubShare Feedback

----

### NIST Privacy Risk Assessment Methodology (PRAM)

The PRAM is a tool that applies the risk model from NISTIR 8062 and helps organizations analyze, assess, and prioritize privacy risks to determine how to respond and select appropriate solutions. The PRAM can help drive collaboration and communication between various components of an organization, including privacy, cybersecurity, business, and IT personnel.

Worksheet 1: Framing Business Objectives and Organizational Privacy GovernanceWorksheet 2: Assessing System Design; Supporting Data MapWorksheet 3: Prioritizing RiskWorksheet 4: Selecting ControlsCatalog of Problematic Data Actions and Problems

**Notes:** NIST welcomes organizations to use the PRAM and share feedback to improve the PRAM.

**Affiliation/Organization(s) Contributing:** NIST**GitHub POC:**@kboeckl

PRAM on GitHubShare Feedback

----

## Interested in contributing? 

Contribute your privacy risk assessment tool.

Contribute

Privacy

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov