# A Perfect Match: Converging and Automating Privacy and Security Impact Assessment On-the-Fly
## 2 The Emergence of Privacy Impact Assessment
### The Current Landscape in PIA Frameworks & Tools
Last but not least, the SPIA Tool is also an adaptable and versatile tool that supports additional threats both security and privacy. _CNIL PIA method and tool:_ The CNIL tool [34] aims to assist data controllers to perform DPIA based on the methodology published by CNIL in [22; 26]. According to CNIL's methodology a PIA is based on two aim aspects:  
* fundamental rights and principles, which are \"non-negotiable\", mandated by law and which must be respected, regardless of the risk nature. * management of data subjects' privacy risks, which determines the appropriate technical and organisational controls to protect personal data. The PIA practitioners need to carry out the following necessary steps:  
* Define and document the context of the data processing action under consideration. * Analysis of controls that can protect fundamental principles. * Assessment and management of privacy risks related to data. * Formal documentation and validation of the PIA. The PIA tool assist the practitioners in fulfilling the above-mentioned steps. The result of the assessment is represented through a heat map, where the risks are positioned based on their criticality and the risk likelihood. CNIL tool supports four levels of severity scales; Negligible, Limited, Significant, Maximum. However, defining the processing activities with the engaged actors and data, and the underlined threats, is a manual process which requires considerable effort by the tool user and deep understanding for the current data processing actions of the organisation. As a result, the tool lacks automation that can increase the awareness of the risk assessor, while the cyber security status, i.e., the vulnerabilities of the ICT assets are not reflected in the final scores. Overall, ENISA's on-line tool [31], consists of six steps for the calculation of the privacy risk. The assessment of risks is the first step towards the adoption of appropriate security measures to protect the personal data. This tool engages the user in a manual process of data entry and does not provide any level of automation. The CNIL's PIA tool [34]considers data controllers that are familiar with the PIA process. This tool lacks automation, in terms of ICT asset inventory and privacy threat and vulnerability detection, that can increase the awareness of the risk assessor, while the resulted risk levels do not consider the cyber security status of the organization. Moreover CNIL's PIA tool does not use visual representation of the information flows, which is a corner stone of DPIA. The scoring criteria of SPIA Tool [33] are difficult to be extracted from the available online sources. According to the tool designers, SPIA is able to conduct both cybersecurity and privacy assessment. However, considering that the the tool is offered in a web environment, it is not destined to interact with the assessed infrastructure and support asset inventory and vulnerability detection functionalities. The scoring criteria of S1 EPC/RFID PIA Tool [32] are rather generalized [37]. Moreover, S1 EPC/RFID PIA Tool is simpler than SPIA Tool, but is incompatible with older computers [37]. Last but not least, S1 EPC/RFID PIA Tool has not been well-received or widely-used and the user community has identified the absence of technology-specific guidance regarding both risks and controls [39]. In addition, it has to be noted that S1 EPC/RFID PIA Tool is a domain specific tool that cannot be considered usable to other application domains. Table 1 offers an overview of the key characteristics of the aforementioned tools and highlights the additional aspects that makes APSIA to excel. In this context, as aforementioned, APSIA aims to bridge the gap between the cyber- and privacy-risk assessment, which are treated as distinct management processes [18; 19].