The updated guidelines address current privacy risk management needs, maintain alignment with NIST’s updated Cybersecurity Framework, and improve usability.
The draft release, “NIST Privacy Framework 1.1 Initial Public Draft,” should help organizations manage privacy risks that arise from personal data flowing through complex information technology systems.
There needed to be change to the Privacy Framework (PFW) because of its relationship to the NIST Cybersecurity Framework (CSF), which received an update of its own in February 2024.
Privacy risk is closely related to, and often overlaps with, cybersecurity risk. Because of this, the two frameworks have the same high-level structure to make them easy to use together.
One element shared by both frameworks is the “Core,” an increasingly granular set of activities and outcomes that can help organizations discuss risk management. The PFW 1.1 Public Draft Core realigns with the CSF 2.0 Core, making life easier on users.
Compatible to Cybersecurity Framework
“This is a modest but significant update,” said NIST’s Julie Chua, director of NIST’s Applied Cybersecurity Division. “The PFW can end up used on its own to manage privacy risks, but we have also maintained its compatibility with CSF 2.0 so that organizations can use them together to manage the full spectrum of privacy and cybersecurity risks.”
- Among the notable changes in PFW 1.1’s draft update are:
- Targeted revisions to the core section. The PFW’s draft update makes targeted changes to its core structure and content. Some changes maintain alignment with CSF 2.0, with a focus on the Govern Function (i.e., risk management strategy and policies) and the Protect Function (i.e., privacy and cybersecurity safeguards).
- A new section on AI and privacy risk management. The initial version of the PFW appeared before the use of AI tools such as chatbots became widespread. The draft PFW’s Section 1.2.2 briefly outlines ways AI and privacy risks relate to one another and how PFW 1.1 can manage AI privacy risks.
- A relocation of the PFW’s use guidelines to the web. Those seeking a guide to using the PFW now can find this information on the web rather than in its former location in Section 3. The online material ended up structured as an interactive FAQ page intended to allow users to find answers quickly. Keeping this section online also will enable timely updates in response to user needs.
NIST is accepting public comments on the draft via email until June 13. A template for submitting comments is on the NIST Privacy Framework website. Following the comment period, NIST will consider additional changes and release a final version later this calendar year.
Click here for the updated NIST privacy framework.