U.S. flag
        An official website of the United States government
          Here’s how you know
        Here’s how you know**Official websites use .gov**
              
              A **.gov** website belongs to an official government organization in the United States.
        **Secure .gov websites use HTTPS**
              
              A **lock** (  A locked padlock
) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/collaboration-space/focus-areas/risk-assessment/tools
  Search NIST
    Search
              Menu

      


Close
    Topics
        All Topics
                                                        Advanced communications
                                                        Artificial intelligence
                                                        Bioscience
                                                        Buildings and construction
                                                        Chemistry
                                                        Climate
                                                        Cybersecurity
                                                        Electronics
                                                        EnergyEnvironment
                                                        Fire
                                                        Forensic science
                                                        Health
                                                        Information technology
                                                        Infrastructure
                                                        Manufacturing
                                                        Materials
                                                        Mathematics and statisticsMetrology
                                                        Nanotechnology
                                                        Neutron research
                                                        Performance excellence
                                                        Physics
                                                        Public safety
                                                        Resilience
                                                        Standards
                                                        Transportation
            Publications
            Labs & Major Programs
        Laboratories
                                Communications Technology Laboratory
                                  Engineering Laboratory
                                  Information Technology Laboratory
                                  Material Measurement Laboratory
                                  Physical Measurement LaboratoryUser Facilities
                                NIST Center for Neutron Research
                                  CNST NanoFab
                                                        Research Test Beds
                                                        Research Projects
                                                        Tools & InstrumentsMajor Programs
                                Baldrige Performance Excellence Program
                                  CHIPS for America Initiative
                                  Manufacturing Extension Partnership (MEP)
                                  Office of Advanced Manufacturing
                                  Special Programs Office
                                  Technology Partnerships Office
            Services & Resources
        Standards and Measurements
                                Calibration Services
                                  Laboratory Accreditation (NVLAP)
                                  Quality System
                                  Standard Reference Materials (SRMs)
                                  Standards.gov
                                  Time Services
                                  Office of Weights and MeasuresSoftware
                                                        Data
                                Chemistry WebBook
                                  National Vulnerability Database
                                  Physical Reference Data
                                  Standard Reference Data (SRD)
                                                        Storefront
                                                        License & PatentsComputer Security Resource Center (CSRC)
                                                        NIST Research Library
            News & Events
        News
                                                        Events
                                                        Blogs
                                                        Feature Stories
                                                        AwardsVideo Gallery
                                                        Image Gallery
                                                        Media Contacts
            About NIST
        About Us
                                Leadership
                                  Organization Structure
                                  Budget & Planning
                                                        Contact Us
                                                        Visit
                                                        Careers
                                Student programsWork with NIST
                                                        History
                                NIST Digital Archives
                                  NIST Museum
                                  NIST and the Nobel
                                                        Educational Resources
 
 Information Technology Laboratory /                  Applied Cybersecurity Division
      Privacy Engineering Program
    
      
  About
                            Expand or Collapse
          Meet the Team
          Collaboration Space
                            Expand or Collapse
          Operating Rules
                                              Expand or Collapse
                Moderators
                      Contribute to Focus Areas
                                              Expand or Collapse
                Contribution Instructions
                      Disassociability
                                              Expand or Collapse
                Tools
                                  Use Cases
                      Privacy Risk Assessment
                                              Expand or Collapse
                Tools
                                  Use Cases
                      Challenges
                                              Expand or Collapse
                Collaborative Challenges
                                  Prize Challenges
                      Blog Series
                                              Expand or Collapse
                Differential Privacy
                                  Privacy-Preserving Federated Learning
          Resources
          Events
          Get Involved



  Connect with us
      
      TwitterGovDeliveryRisk Assessment Tools

Share
  Facebook
                      Linkedin
                      Twitter
                      Email

Return to Risk Assessment

Privado Scan

Privado Scan is an open-source privacy scanner that allows an engineer to scan their application code and discover how data flows in the application. It detects hundreds of personal data elements being processed and further maps the data flow from the point of collection to "sinks" such as external third parties, databases, logs, and internal APIs. It allows privacy engineers to concretely verify and assess if a certain data collection policy set on an application actually matches the implementation right in the code itself - thus embedding privacy assessments in the developers' workflow.

**Additional Info:** Here are some resources to learn how Privado Scan works and how to contribute to it:

Source: Rules, Engine
	Docs: https://docs.privado.ai
	Use Cases:
	Generate and maintain data maps and Record of Processing Activity (RoPA) Reports by scanning code
		Discover and classify personal data elements inside the application's code and verify if they adhere to privacy policies
		Get comprehensive insight on dataflows within an application from interesting sources (such as user input forms) to interesting sinks (such as logs, external services, third parties, databases etc.)
		Verify and enforce data protection and governance policies right in code
		Assess private data leakage risks by directly verifying it at an engineering level (eg. verify if a developer collected precise location in a phone app and if it was actualy sent to a remote third party logging service)
	Talks/Videos: *Building an Automated Machine for Discovering Privacy Violations at Scale (Usenix Enigma 2023)* [Link]Feedback and suggestions for improvement of Privado Scan are welcome. Please reach out to Privado on the Privado Slack Community.

**Affiliation/Organization(s) Contributing:** Privado Inc. **GitHub POC:**@tuxology

Privado Scan on GitHub   Share Feedback

FAIR Privacy

FAIR Privacy is a quantitative privacy risk framework based on FAIR (Factors Analysis in Information Risk). FAIR Privacy examines personal privacy risks (to individuals), not organizational risks. Included in this tool is a PowerPoint deck illustrating the components of FAIR Privacy and an example based on a hypothetical smart lock manufacturer. In addition, an Excel spreadsheet provides a powerful risk calculator using Monte Carlo simulation.

**Notes:** *V2.11 March 2022 Update:*A revised version of the PowerPoint deck and calculator are provided based on the example used in the paper "Quantitative Privacy Risk" presented at the 2021 International Workshop on Privacy Engineering (https://ieeexplore.ieee.org/document/9583709). The newer Excel based calculator:

uses a Poisson distribution for threat opportunity (previously Beta-PERT)
	uses Binomial distribution for Attempt Frequency and Violation Frequency (Note: inherent baseline risk assumes 100% vulnerability)
	provides a method of calculating organizational risk tolerance
	provides a second risk calculator for comparison between two risks for help prioritizing efforts
	provides a tab for comparing inherent/baseline risk to residual risk, risk tolerance and the other risk tab
	increased instructional text
	genericization of privacy harm and adverse tangible consequencesSome additional resources are provided in the PowerPoint deck. Feedback and suggestions for improvement on both the framework and the included calculator are welcome. Additionally, analysis of the spreadsheet by a statistician is most welcome.

**Affiliation/Organization(s) Contributing:** Enterprivacy Consulting Group**GitHub POC:**@privacymaverick

FAIR Privacy on GitHub   Share Feedback

NIST Privacy Risk Assessment Methodology (PRAM)

The PRAM is a tool that applies the risk model from NISTIR 8062 and helps organizations analyze, assess, and prioritize privacy risks to determine how to respond and select appropriate solutions. The PRAM can help drive collaboration and communication between various components of an organization, including privacy, cybersecurity, business, and IT personnel.

Worksheet 1: Framing Business Objectives and Organizational Privacy Governance
Worksheet 2: Assessing System Design; Supporting Data Map
Worksheet 3: Prioritizing Risk
Worksheet 4: Selecting Controls
Catalog of Problematic Data Actions and Problems

**Notes:** NIST welcomes organizations to use the PRAM and share feedback to improve the PRAM.

**Affiliation/Organization(s) Contributing:** NIST**GitHub POC:**@kboeckl

PRAM on GitHub   Share Feedback

Interested in contributing?

Contribute your privacy risk assessment tool.

Contribute
  Privacy

    
    Created October 28, 2018, Updated November 16, 2023
 HEADQUARTERS
            100 Bureau Drive
              Gaithersburg, MD 20899301-975-2000
            Webmaster | Contact Us | Our Other Offices
        Twitter
            
Facebook
            
LinkedIn
            
Instagram
            
YouTube
            
Giphy
            
RSS Feed
            
Mailing List
                              How are we doing? Feedback

  
  Site Privacy
                      Accessibility
                      Privacy Program
                      Copyrights
                      Vulnerability Disclosure
                      No Fear Act Policy
                      FOIA
                      Environmental Policy
                      Scientific Integrity
                      Information Quality Standards
                      Commerce.gov
                      Science.gov
                      USA.gov
                      Vote.gov