From: Gideon T.
Rasmussen, CISSP, CRISC, CISA, CISM, CIPP
Sent: Sunday,
June 1, 2025 6:01 PM
To: privacyframework@nist.gov
Cc: Meghan
Anderson; Nakia Grayson;
Julie Chua; Katerina Megas;
Mary Rasmussen; Kaeli Rasmussen; Hunter Rasmussen
Subject: Feedback:
NIST Privacy Framework 1.1 Initial Public Draft
NIST Privacy
Framework Team,
Thanks for the
opportunity to provide commentary on v1.1. Here is my response to your request for feedback:
I. Tactical:
NIST Privacy Framework (PFW) v1.1
1. Solidify
the partnership between privacy and cybersecurity
Recommendation: Provide mapping to the NIST
Cybersecurity Framework v2.0 when PFW v1.1 is published. Feel free to leverage
the mapping table at the bottom of this e-mail.
Privacy and
information security teams need to determine which PFW controls apply to
their respective programs. That prevents duplication of effort and enables
accountability.
• A subset of PFW requirements have been copied-and-pasted
from NIST CSF. There is opportunity for the information security program to
continue managing them, with the privacy team consulted or informed (reference
to the RACI model, responsible, accountable, consulted and informed).
• Some PFW requirements have scope within both privacy and
information security programs. There are shared responsibilities to discuss.
• Remaining PFW requirements are pure-play privacy controls.
They do not map to NIST CSF. The privacy team has point from them.
RACI
designations enable a sub-set of PFW controls to be managed within the
information security program, while the privacy team retains line-of-sight.
2. Add a
visualization to PFW v1.1
There are 59
PFW requirements that map to the CSF. Given there are 104 PFW requirements,
that leaves 45 pure-play privacy controls within NIST PFW v1.1.
3. Delete
entries from PFW v1.1
• Delete 15
new/draft PFW entries that have been copied-and-pasted from the NIST
Cybersecurity Framework v2.0.
- PR.AA-P1: Identities and credentials for authorized
individuals, services, and hardware are managed by the organization. [NIST CSF v2.0: PR.AA-01]
- PR.AA-P2: Identities are proofed and bound to credentials
based on the context of interactions. [NIST CSF v2.0: PR.AA-02]
- PR.AA-P3: Individuals, services, and hardware are
authenticated commensurate with risk. [NIST CSF v2.0: PR.AA-03]
- PR.AA-P4: Identity assertions are protected, conveyed, and
verified. [NIST CSF v2.0:
PR.AA-04]
- PR.AA-05: Access permissions, entitlements, and authorizations
are defined in a policy, managed, enforced, and reviewed, and incorporate the
principles of least privilege and separation of duties. [NIST CSF v2.0: PR.AA-05]
- PR.AA-P6: Physical access to data and devices is managed,
monitored, and enforced commensurate with risk. [NIST CSF v2.0: PR.AA-06]
- PR.DS-P10: Backups of data are created, protected, maintained,
and tested. [NIST CSF
v2.0: PR.DS-11]
- PR.PS-P1: Configuration management practices are established
and applied. [NIST CSF
v2.0: PR.PS-01]
- PR.PS-P2: Software is maintained, replaced, and removed
commensurate with risk. [NIST
CSF v2.0: PR.PS-02]
- PR.PS-P3: Hardware is maintained, replaced, and removed
commensurate with risk. [NIST
CSF v2.0: PR.PS-03]
- PR.PS-P4: Installation and execution of unauthorized software
are prevented. [NIST CSF
v2.0: PR.PS-05]
- PR.IR-P1: Networks and environments are protected from
unauthorized logical access and usage. [NIST CSF v2.0: PR.IR-01]
- PR.IR-P2: The organization s technology assets, including
associated data, are protected from environmental threats. [NIST CSF v2.0: PR.IR-02]
- PR.IR-P3: Mechanisms are implemented to achieve resilience
requirements in normal and adverse situations. [NIST CSF v2.0: PR.IR-03]
- PR.IR-P4: Adequate resource capacity to ensure availability is
maintained. [NIST CSF
v2.0: PR.IR-04]
(Privacy
practitioners need less NIST CSF entries within the PFW, not more.)
PR.DS-P9: The confidentiality, integrity, and availability of
data-in-use are protected.
(This newly
added entry is more of a strategic goal or aspirational statement than it is a
control objective.)
4. Add
guidance from reputable sources.
a. Create
control requirements from H.R.8818 - American Privacy Rights Act of 2024:
- Covered entities and service providers operating on their
behalf shall not collect, process, retain, or transfer data beyond what is
necessary, proportionate, or limited to provide or maintain a product or
service requested by an individual, or provide a communication reasonably
anticipated in the context of the relationship, or a permitted purpose.
- Covered entities and service providers must have publicly
available privacy policies detailing their data privacy and security practices.
- The privacy policies must identify the entity; disclose the
categories of data collected, processed, or retained; the purposes for the data
processing; the categories of service providers and third parties to which data
is transferred; the name of any data brokers to which data is transferred; the
length of time data is retained; data security practices; and the effective
date of the privacy policy.
- Privacy policies must prominently describe how consumers can
exercise their individual controls and opt-out rights.
- Covered entities must comply with individual control rights
within specified timeframes, and large data holders must report metrics related
to the requests they process.
- Covered entities may deny an individual s request if the
request would be demonstrably impossible; would require deleting data necessary
to perform a contract; would require the release of trade secrets; or would
prevent the maintenance of a confidential record of opt-out rights.
- A consumer has the right to opt out of the use of their
personal information for targeted advertising.
b. Create a
control requirement from Adopting AI Responsibly: Guidelines for Procurement -
World Economic Forum:
- The AI explainability statement is a public document released
by an AI organization that outlines how its AI algorithms work, its intended
use, technology infrastructure, model accuracy, bias detection and mitigation,
system maintenance, risk management, ethical principles, and data sources
The above
narrative provides inspiration for Third Party Risk Management programs and
vendor contract addendums.
II.
Strategic: PFW v1.2 and beyond
1. Provide
PFW implementation examples.
NIST CSF v2.0
has 363 implementation examples. By the mapping below, that covers 59 PFW
requirements, leaving only 45 'pure play' privacy controls that need
implementation examples.
2. Reference
supporting documents.
Two or three
words in the PFW can cause significant challenges for privacy officers.
Consider providing links to reputable guidance for privacy controls such as:
• Privacy
notice
• Privacy
impact assessment
• Data actions
inventory
There is also
opportunity to create Information Supplements, similar to those published by
the PCI Security Standards Council.
3. Merge the
privacy and cybersecurity frameworks.
There is
opportunity for the PFW and the CSF to merge into one framework for ease of
use. Some entries could be combined such as:
• NIST PFW v1.1: GV.PO-P7: Privacy procedures are included in
human resources practices (e.g., deprovisioning, personnel screening).
• NIST CSF v2.0: GV.RR-04: Cybersecurity is included in human
resources practices - Ex1: Integrate cybersecurity risk management
considerations into human resources processes (e.g., personnel screening,
onboarding, change notification, offboarding)
There are 59
PFW requirements that map to the CSF. Merging the two frameworks would reduce
compliance burden.
NIST PFW
Team: Thanks so much
for your efforts to protect consumer privacy! Many organizations have adopted
the PFW. Your edits will provide clarity in a time where 19 fragmented state
privacy laws make life difficult for businesses.
Feel free to
reach out to me with questions or comments.
Gideon
Gideon T. Rasmussen | CISSP, CRISC, CISA,
CISM, CIPP | Consultant
Virtual CSO, LLC | www.virtualcso.com | www.gideonras.com
The opinions expressed here are my own and not necessarily those
of my current or past clients/employers.
|
NIST PFW
v1.1 IPD |
Control
Description |
NIST CSF
v2.0 |
Control Description |
Implementation Examples |
|
ID.IM-P1 |
Systems/products/services
that process data are inventoried. |
ID.AM-01 |
Inventories
of hardware managed by the organization are maintained |
Ex1: Maintain inventories for all types of hardware,
including IT, IoT, OT, and mobile devices |
|
ID.AM-02 |
Inventories
of software, services, and systems managed by the organization are maintained |
Ex1: Maintain inventories for all types of software and
services, including commercial-off-the-shelf, open-source, custom
applications, API services, and cloud-based applications and services Ex2:
Constantly monitor all platforms, including containers and virtual machines,
for software and service inventory changes |
||
|
ID.IM-P2 |
Owners
or operators (e.g., the organization or third parties such as service
providers, partners, customers, and developers) and their roles with respect
to the systems/products/services and components (e.g., internal or external)
that process data are inventoried. |
ID.AM-04 |
Inventories
of services provided by suppliers are maintained |
Ex1: Inventory all external services used by the
organization, including third-party infrastructure-as-a-service (IaaS),
platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings;
APIs; and other externally hosted application services |
|
ID.IM-P3 |
Categories
of individuals (e.g., customers, employees or prospective employees,
consumers) whose data are being processed are inventoried. |
|
|
|
|
ID.IM-P4 |
Data
actions of the systems/products/services are inventoried. |
|
|
|
|
ID.IM-P5 |
The
purposes for the data actions are inventoried. |
|
|
|
|
ID.IM-P6 |
Data
elements within the data actions are inventoried. |
|
|
|
|
ID.IM-P7 |
The
data processing environment is identified (e.g., geographic location,
internal, cloud, third parties). |
ID.AM-01 |
Inventories
of hardware managed by the organization are maintained |
Ex1: Maintain inventories for all types of hardware,
including IT, IoT, OT, and mobile devices |
|
ID.AM-02 |
Inventories
of software, services, and systems managed by the organization are maintained |
Ex1: Maintain inventories for all types of software and
services, including commercial-off-the-shelf, open-source, custom
applications, API services, and cloud-based applications and services Ex2:
Constantly monitor all platforms, including containers and virtual machines,
for software and service inventory changes |
||
|
ID.AM-04 |
Inventories
of services provided by suppliers are maintained |
Ex1: Inventory all external services used by the
organization, including third-party infrastructure-as-a-service (IaaS),
platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings;
APIs; and other externally hosted application services |
||
|
ID.IM-P8 |
Data
processing is mapped, illustrating the data actions and associated data
elements for systems/products/services, including components; roles of the
component owners/operators; and interactions of individuals or third parties
with the systems/products/services. |
|
|
|
|
ID.BE-P1 |
The
organization s role(s) in the data processing ecosystem are identified,
communicated, and understood. |
|
|
|
|
ID.BE-P2 |
The
organizational mission is identified, communicated, and understood and
informs privacy risk management. |
GV.OC-01 |
The
organizational mission is understood and informs cybersecurity risk
management |
Ex1: Share the organization s mission (e.g., through vision
and mission statements, marketing, and service strategies) to provide a basis
for identifying risks that may impede that mission |
|
ID.BE-P3 |
Systems/products/services
that support organizational priorities are identified and key requirements
communicated and understood. |
|
|
|
|
ID.BE-P4 |
Data
processing ecosystem parties (e.g., service providers, customers, partners,
product manufacturers, application developers) are identified and
prioritized. |
GV.SC-04 |
Suppliers
are known and prioritized by criticality |
Ex1: Develop criteria for supplier criticality based on, for
example, the sensitivity of data processed or possessed by suppliers, the
degree of access to the organization s systems, and the importance of the
products or services to the organization s mission |
|
ID.BE-P5 |
Objectives,
capabilities, and services that stakeholders depend on or expect from the
organization are identified, communicated, and understood. |
GV.OC-04 |
Critical
objectives, capabilities, and services that stakeholders depend on or expect
from the organization are understood and communicated |
Ex1: Establish criteria for determining the criticality of
capabilities and services as viewed by internal and external stakeholders |
|
ID.BE-P6 |
Outcomes,
capabilities, and services that the organization depends on are identified,
communicated, and understood. |
GV.OC-05 |
Outcomes,
capabilities, and services that the organization depends on are understood
and communicated |
Ex1: Create an inventory of the organization s dependencies
on external resources (e.g., facilities, cloud-based hosting providers) and
their relationships to organizational assets and business functions |
|
ID.RA-P1 |
Contextual
factors related to the systems/products/services and the data actions are
identified (e.g., individuals demographics and privacy interests or
perceptions, data sensitivity and/or types, visibility of data processing to
individuals and third parties). |
|
|
|
|
|
|
|
|
|
|
ID.RA-P3 |
Potential
problematic data actions and associated problems are identified. |
|
|
|
|
ID.RA-P4 |
Problematic
data actions, likelihoods, and impacts are used to determine and prioritize
risk. |
ID.RA-04 |
Potential
impacts and likelihoods of threats exploiting vulnerabilities are identified
and recorded |
Ex1: Business leaders and cybersecurity risk management
practitioners work together to estimate the likelihood and impact of risk
scenarios and record them in risk registers |
|
ID.RA-05 |
Threats,
vulnerabilities, likelihoods, and impacts are used to understand inherent
risk and inform risk response prioritization |
Ex1: Develop threat models to better understand risks to the
data and identify appropriate risk responses |
||
|
ID.RA-P5 |
Risk
responses are identified, prioritized, and implemented. |
ID.RA-06 |
Risk
responses are chosen, prioritized, planned, tracked, and communicated |
Ex1: Apply the vulnerability management plan s criteria for
deciding whether to accept, transfer, mitigate, or avoid risk |
|
ID.RA-P6 |
Data
processing ecosystem parties (e.g., service providers, customers, partners,
product manufacturers, application developers) are assessed using a privacy
risk assessment process. |
GV.SC-06 |
Planning
and due diligence are performed to reduce risks before entering into formal
supplier or other third-party relationships |
Ex1: Perform thorough due diligence on prospective suppliers
that is consistent with procurement planning and commensurate with the level
of risk, criticality, and complexity of each supplier relationship |
|
GV.SC-07 |
The
risks posed by a supplier, their products and services, and other third
parties are understood, recorded, prioritized, assessed, responded to, and
monitored over the course of the relationship |
Ex1: Adjust assessment formats and frequencies based on the
third party s reputation and the criticality of the products or services they
provide |
||
|
ID.RA-10 |
Critical
suppliers are assessed prior to acquisition |
Ex1: Conduct supplier risk assessments against business and
applicable cybersecurity requirements, including the supply chain |
||
|
GV.PO-P1 |
Organizational
privacy values and policies (e.g., conditions on data processing such as data
uses or retention periods, individuals prerogatives with respect to data
processing) are established, communicated, and enforced. |
|
|
|
|
GV.PO-P2 |
Processes
to instill organizational privacy values within system/product/service
development and operations are established and in place. |
|
|
|
|
GV.PO-P5 |
Legal,
regulatory, and contractual requirements regarding privacy are understood and
managed. |
GV.OC-03 |
Legal,
regulatory, and contractual requirements regarding cybersecurity including
privacy and civil liberties obligations are understood and managed |
Ex1: Determine a process to track and manage legal and
regulatory requirements regarding protection of individuals information
(e.g., Health Insurance Portability and Accountability Act, California
Consumer Privacy Act, General Data Protection Regulation) Ex2:
Determine a process to track and manage contractual requirements for
cybersecurity management of supplier, customer, and partner information |
|
GV.PO-P6 |
Governance
and enterprise risk management policies, processes, and procedures address
privacy risks. |
GV.RM-03 |
Cybersecurity
risk management activities and outcomes are included in enterprise risk
management processes |
Ex1: Aggregate and manage cybersecurity risks alongside
other enterprise risks (e.g., compliance, financial, operational, regulatory,
reputational, safety) |
|
GV.PO-P7 |
Privacy
procedures are included in human resources practices (e.g., deprovisioning,
personnel screening). |
GV.RR-04 |
Cybersecurity
is included in human resources practices |
Ex1: Integrate cybersecurity risk management considerations
into human resources processes (e.g., personnel screening, onboarding, change
notification, offboarding) |
|
GV.RM-P1 |
Risk
management objectives and processes are established, managed, and agreed to
by organizational stakeholders. |
GV.RM-01 |
Risk
management objectives are established and agreed to by organizational
stakeholders |
Ex1: Update near-term and long-term cybersecurity risk
management objectives as part of annual strategic planning and when major
changes occur |
|
GV.RM-P2 |
The
organization s risk appetite and risk tolerance are determined and
communicated and are informed by the organization's role(s) in the data
processing ecosystem. |
GV.RM-02 |
Risk
appetite and risk tolerance statements are established, communicated, and
maintained |
Ex1: Determine and communicate risk appetite statements that
convey expectations about the appropriate level of risk for the organization |
|
GV.RM-P4 |
Strategic
direction that describes appropriate risk response options is established and
communicated. |
GV.RM-04 |
Strategic
direction that describes appropriate risk response options is established and
communicated |
Ex1: Specify criteria for accepting and avoiding
cybersecurity risk for various classifications of data |
|
GV.RM-P5 |
Lines
of communication across the organization are established for privacy risks,
including risks from data processing ecosystem parties. |
GV.RM-05 |
Lines
of communication across the organization are established for cybersecurity
risks, including risks from suppliers and other third parties |
Ex1: Determine how to update senior executives, directors,
and management on the organization s cybersecurity posture at agreed-upon
intervals |
|
GV.RM-P6 |
A
standardized method for calculating, documenting, categorizing, and
prioritizing privacy risks is established and communicated. |
GV.RM-06 |
A
standardized method for calculating, documenting, categorizing, and
prioritizing cybersecurity risks is established and communicated |
Ex1: Establish criteria for using a quantitative approach to
cybersecurity risk analysis, and specify probability and exposure formulas |
|
GV.RM-P7 |
Strategic
opportunities (i.e., positive risks) are characterized and included in
organizational privacy risk discussions. |
GV.RM-07 |
Strategic
opportunities (i.e., positive risks) are characterized and are included in
organizational cybersecurity risk discussions |
Ex1: Define and communicate guidance and methods for
identifying opportunities and including them in risk discussions (e.g.,
strengths, weaknesses, opportunities, and threats [SWOT] analysis) |
|
GV.OV-P1 |
Privacy
risk management strategy outcomes are reviewed to inform and adjust strategy
and direction. |
GV.OV-01 |
Cybersecurity
risk management strategy outcomes are reviewed to inform and adjust strategy
and direction |
Ex1: Measure how well the risk management strategy and risk
results have helped leaders make decisions and achieve organizational
objectives |
|
GV.OV-P2 |
The
privacy risk management strategy is reviewed and adjusted to ensure coverage
of organizational requirements and risks. |
GV.OV-02 |
The
cybersecurity risk management strategy is reviewed and adjusted to ensure
coverage of organizational requirements and risks |
Ex1: Review audit findings to confirm whether the existing
cybersecurity strategy has ensured compliance with internal and external
requirements |
|
GV.OV-P3 |
Organizational
privacy risk management performance is measured and reviewed to confirm and
adjust strategic direction. |
GV.OV-03 |
Organizational
cybersecurity risk management performance is evaluated and reviewed for
adjustments needed |
Ex1: Review key performance indicators (KPIs) to ensure that
organization-wide policies and procedures achieve objectives |
|
GV.RR-P1 |
Organizational
leadership is responsible and accountable for privacy risk and fosters a
culture that is risk-aware, ethical, and continually improving. |
GV.RR-01 |
Organizational
leadership is responsible and accountable for cybersecurity risk and fosters
a culture that is risk-aware, ethical, and continually improving |
Ex1: Leaders (e.g., directors) agree on their roles and
responsibilities in developing, implementing, and assessing the
organization s cybersecurity strategy |
|
GV.RR-P2 |
Roles
and responsibilities for the workforce are established with respect to
privacy. |
GV.RR-02 |
Roles,
responsibilities, and authorities related to cybersecurity risk management
are established, communicated, understood, and enforced |
Ex1: Document risk management roles and responsibilities in
policy |
|
GV.RR-P3 |
Privacy
roles and responsibilities are coordinated and aligned with external
stakeholders (e.g., service providers, customers, partners). |
GV.SC-02 |
Cybersecurity
roles and responsibilities for suppliers, customers, and partners are
established, communicated, and coordinated internally and externally |
Ex1: Identify one or more specific roles or positions that
will be responsible and accountable for planning, resourcing, and executing
cybersecurity supply chain risk management activities |
|
GV.RR-P4 |
Adequate
resources are allocated commensurate with privacy risk strategy, roles and
responsibilities, and policies. |
GV.RR-03 |
Adequate
resources are allocated commensurate with the cybersecurity risk strategy,
roles, responsibilities, and policies |
Ex1: Conduct periodic management reviews to ensure that
those given cybersecurity risk management responsibilities have the necessary
authority |
|
GV.DE-P1 |
Data
processing ecosystem risk management strategy, objectives, policies, and
processes are established and agreed to by organizational stakeholders. |
GV.PO-01 |
Policy
for managing cybersecurity risks is established based on organizational
context, cybersecurity strategy, and priorities and is communicated and
enforced |
Ex1: Create, disseminate, and maintain an understandable,
usable risk management policy with statements of management intent,
expectations, and direction |
|
GV.DE-P2 |
Contracts
with data processing ecosystem parties are used to implement appropriate
measures designed to meet the objectives of an organization s privacy
program. |
GV.SC-05 |
Requirements
to address cybersecurity risks in supply chains are established, prioritized,
and integrated into contracts and other types of agreements with suppliers
and other relevant third parties |
Ex1: Establish security requirements for suppliers,
products, and services commensurate with their criticality level and
potential impact if compromised |
|
GV.DE-P3 |
Interoperability
frameworks or similar multi-party approaches are used to manage data
processing ecosystem privacy risks. |
|
|
|
|
GV.DE-P4 |
Data
processing ecosystem parties are routinely assessed using audits, test
results, or other forms of evaluations to confirm they are meeting their
contractual, interoperability framework, or other obligations. |
GV.SC-07 |
The
risks posed by a supplier, their products and services, and other third
parties are understood, recorded, prioritized, assessed, responded to, and
monitored over the course of the relationship |
Ex1: Adjust assessment formats and frequencies based on the
third party s reputation and the criticality of the products or services they
provide |
|
GV.DE-P5 |
Data
processing ecosystem risk management is integrated into privacy and
enterprise risk management, risk assessment, and improvement processes. |
GV.PO-01 |
Policy
for managing cybersecurity risks is established based on organizational
context, cybersecurity strategy, and priorities and is communicated and
enforced |
Ex1: Create, disseminate, and maintain an understandable,
usable risk management policy with statements of management intent,
expectations, and direction |
|
GV.AT-P1 |
Personnel
are provided with awareness and training so that they possess the knowledge
and skills to perform privacy-related tasks. |
PR.AT-01 |
Personnel
are provided with awareness and training so that they possess the knowledge
and skills to perform general tasks with cybersecurity risks in mind |
Ex1: Provide basic cybersecurity awareness and training to
employees, contractors, partners, suppliers, and all other users of the
organization s non-public resources |
|
GV.AT-P2 |
Individuals
in specialized roles are provided with awareness and training so that they
possess the knowledge and skills to perform privacy-related tasks. |
PR.AT-02 |
Individuals
in specialized roles are provided with awareness and training so that they
possess the knowledge and skills to perform relevant tasks with cybersecurity
risks in mind |
Ex1: Identify the specialized roles within the organization
that require additional cybersecurity training, such as physical and
cybersecurity personnel, finance personnel, senior leadership, and anyone
with access to business-critical data |
|
GV.MT-P1 |
Privacy
risk is re-evaluated on an ongoing basis and as key factors, including the
organization s business environment (e.g., introduction of new technologies),
governance (e.g., legal obligations, risk tolerance), data processing, and
systems/products/services change. |
GV.PO-02 |
Policy
for managing cybersecurity risks is reviewed, updated, communicated, and
enforced to reflect changes in requirements, threats, technology, and
organizational mission |
Ex1: Update policy based on periodic reviews of
cybersecurity risk management results to ensure that policy and supporting
processes and procedures adequately maintain risk at an acceptable level |
|
GV.MT-P2 |
Privacy
values, policies, and training are reviewed and any updates are communicated. |
GV.PO-02 |
Policy
for managing cybersecurity risks is reviewed, updated, communicated, and
enforced to reflect changes in requirements, threats, technology, and
organizational mission |
Ex2: Provide a timeline for reviewing changes to the
organization s risk environment (e.g., changes in risk or in the
organization s mission objectives), and communicate recommended policy
updates |
|
GV.MT-P3 |
Policies,
processes, and procedures for assessing compliance with legal requirements
and privacy policies are established and in place. |
GV.PO-02 |
Policy
for managing cybersecurity risks is reviewed, updated, communicated, and
enforced to reflect changes in requirements, threats, technology, and
organizational mission |
Ex3: Update policy to reflect changes in legal and
regulatory requirements |
|
GV.MT-P4 |
Policies,
processes, and procedures for communicating progress on managing privacy
risks are established and in place. |
|
|
|
|
GV.MT-P5 |
Policies,
processes, and procedures are established and in place to receive, analyze,
and respond to problematic data actions disclosed to the organization from
internal and external sources (e.g., internal discovery, privacy researchers,
professional events). |
|
|
|
|
GV.MT-P6 |
Policies,
processes, and procedures incorporate lessons learned from problematic data
actions. |
|
|
|
|
GV.MT-P7 |
Policies,
processes, and procedures for receiving, tracking, and responding to
complaints, concerns, and questions from individuals about organizational
privacy practices are established and in place. |
|
|
|
|
CT.PO-P1 |
Policies,
processes, and procedures for authorizing data processing (e.g.,
organizational decisions, individual consent), revoking authorizations, and
maintaining authorizations are established and in place. |
|
|
|
|
CT.PO-P2 |
Policies,
processes, and procedures for enabling data review, transfer, sharing or
disclosure, alteration, and deletion are established and in place (e.g., to
maintain data quality, manage data retention). |
|
|
|
|
CT.PO-P3 |
Policies,
processes, and procedures for enabling individuals data processing
preferences and requests are established and in place. |
|
|
|
|
CT.PO-P4 |
A
data life cycle to manage data is aligned and implemented with the system
development life cycle to manage systems. |
ID.AM-08 |
Systems,
hardware, software, services, and data are managed throughout their life
cycles |
Ex1: Integrate cybersecurity considerations throughout the
life cycles of systems, hardware, software, and services |
|
CT.DM-P1 |
Data
elements can be accessed for review. |
|
|
|
|
CT.DM-P2 |
Data
elements can be accessed for transmission or disclosure. |
|
|
|
|
CT.DM-P3 |
Data
elements can be accessed for alteration. |
|
|
|
|
CT.DM-P4 |
Data
elements can be accessed for deletion. |
|
|
|
|
CT.DM-P5 |
Data
are destroyed according to policy. |
ID.AM-08 |
Systems,
hardware, software, services, and data are managed throughout their life
cycles |
Ex7: Securely destroy stored data based on the
organization s data retention policy using the prescribed destruction method,
and keep and manage a record of the destructions |
|
CT.DM-P6 |
Data
are transmitted using standardized formats. |
|
|
|
|
CT.DM-P7 |
Mechanisms
for transmitting processing permissions are established and in place. |
|
|
|
|
CT.DM-P8 |
Mechanisms
for transmitting data elements in accordance with processing permissions are
established and in place. |
|
|
|
|
CT.DM-P9 |
Log
records are determined, documented, implemented, and reviewed in accordance
with policy and incorporating the principle of data minimization. |
PR.PS-04 |
Log
records are generated and made available for continuous monitoring |
Ex1: Configure all operating systems, applications, and
services (including cloud-based services) to generate log records |
|
DE.AE-02 |
Potentially
adverse events are analyzed to better understand associated activities |
Ex1: Use security information and event management (SIEM) or
other tools to continuously monitor log events for known malicious and
suspicious activity |
||
|
CT.DM-P10 |
Technical
measures implemented to manage data processing are tested and assessed. |
|
|
|
|
CT.DM-P11 |
Stakeholder
privacy preferences are included in algorithmic design objectives and outputs
are evaluated against these preferences. |
|
|
|
|
CT.DP-P1 |
Data
are processed to limit observability, linkability, and singling out (e.g.,
data actions take place on local devices, privacy-preserving cryptography). |
|
|
|
|
CT.DP-P2 |
Data
are processed to limit the identification of individuals (e.g.,
de-identification privacy techniques, tokenization). |
|
|
|
|
CT.DP-P3 |
Data
are processed to limit the formulation of inferences about individuals
behavior or activities (e.g., data processing is decentralized, distributed
architectures). |
|
|
|
|
CT.DP-P4 |
System
or device configurations permit selective collection or disclosure of data
elements. |
|
|
|
|
CT.DP-P5 |
Attribute
values are substituted with derived attribute values (e.g., providing an
"age older than" statement rather than the actual age). |
|
|
|
|
CM.PO-P1 |
Transparency
policies, processes, and procedures for communicating data processing
purposes, practices, and associated privacy risks are established and in
place. |
|
|
|
|
CM.PO-P2 |
Roles
and responsibilities (e.g., public relations) for communicating data
processing purposes, practices, and associated privacy risks are established. |
|
|
|
|
CM.AW-P1 |
Mechanisms
(e.g., notices, internal or public reports) for communicating data processing
purposes, practices, associated privacy risks, and options for enabling
individuals data processing preferences and requests are established and in
place. |
|
|
|
|
CM.AW-P2 |
Mechanisms
for obtaining feedback from individuals (e.g., surveys or focus groups) about
data processing and associated privacy risks are established and in place. |
|
|
|
|
CM.AW-P3 |
System/product/service
design enables data processing visibility. |
|
|
|
|
CM.AW-P4 |
Records
of data disclosures and sharing are maintained and can be accessed for review
or transmission/disclosure. |
|
|
|
|
CM.AW-P5 |
Data
corrections or deletions can be communicated to individuals or organizations
(e.g., data sources) in the data processing ecosystem. |
|
|
|
|
CM.AW-P6 |
Data
provenance and lineage are maintained and can be accessed for review or
transmission/disclosure. |
|
|
|
|
CM.AW-P7 |
Impacted
individuals and organizations are notified about a privacy breach or event. |
|
|
|
|
CM.AW-P8 |
Individuals
are provided with mitigation mechanisms (e.g., credit monitoring, consent
withdrawal, data alteration or deletion) to address impacts of problematic
data actions. |
|
|
|
|
PR.PO-P5 |
Improvements
to data protection policies, processes, and procedures are identified (e.g.,
from evaluations, security tests and exercises, execution of policies,
processes, and procedures), communicated, and implemented. |
ID.IM-01 |
Improvements
are identified from evaluations |
Ex1: Perform self-assessments of critical services that take
current threats and TTPs into consideration |
|
ID.IM-03 |
Improvements
are identified from execution of operational processes, procedures, and
activities |
Ex1: Conduct collaborative lessons learned sessions with
suppliers |
||
|
PR.PO-P7 |
Incident
response and recovery plans are established, communicated, maintained, and
improved. |
ID.IM-04 |
Incident
response plans and other cybersecurity plans that affect operations are
established, communicated, maintained, and improved |
Ex1: Establish contingency plans (e.g., incident response,
business continuity, disaster recovery) for responding to and recovering from
adverse events that can interfere with operations, expose confidential
information, or otherwise endanger the organization s mission and viability |
|
ID.IM-02 |
Improvements
are identified from security tests and exercises, including those done in
coordination with suppliers and relevant third parties |
Ex1: Identify improvements for future incident response
activities based on findings from incident response assessments (e.g.,
tabletop exercises and simulations, tests, internal reviews, independent
audits) |
||
|
PR.AA-P1 |
Identities
and credentials for authorized individuals, services, and hardware are
managed by the organization. |
PR.AA-01 |
Identities
and credentials for authorized users, services, and hardware are managed by
the organization |
Ex1: Initiate requests for new access or additional access
for employees, contractors, and others, and track, review, and fulfill the
requests, with permission from system or data owners when needed |
|
PR.AA-P2 |
Identities
are proofed and bound to credentials based on the context of interactions. |
PR.AA-02 |
Identities
are proofed and bound to credentials based on the context of interactions |
Ex1: Verify a person s claimed identity at enrollment time
using government-issued identity credentials (e.g., passport, visa, driver s
license) |
|
PR.AA-P3 |
Individuals,
services, and hardware are authenticated commensurate with risk. |
PR.AA-03 |
Users,
services, and hardware are authenticated |
Ex1: Require multifactor authentication |
|
PR.AA-P4 |
Identity
assertions are protected, conveyed, and verified. |
PR.AA-04 |
Identity
assertions are protected, conveyed, and verified |
Ex1: Protect identity assertions that are used to convey
authentication and user information through single sign-on systems |
|
PR.AA-P5 |
Access
permissions, entitlements, and authorizations are defined in a policy,
managed, enforced, and reviewed, and incorporate the principles of least
privilege and separation of duties. |
PR.AA-05 |
Access
permissions, entitlements, and authorizations are defined in a policy,
managed, enforced, and reviewed, and incorporate the principles of least
privilege and separation of duties |
Ex1: Review logical and physical access privileges
periodically and whenever someone changes roles or leaves the organization,
and promptly rescind privileges that are no longer needed |
|
PR.AA-P6 |
Physical
access to data and devices is managed, monitored, and enforced commensurate
with risk. |
PR.AA-06 |
Physical
access to assets is managed, monitored, and enforced commensurate with risk |
Ex1: Use security guards, security cameras, locked
entrances, alarm systems, and other physical controls to monitor facilities
and restrict access |
|
PR.DS-P1 |
The
confidentiality, integrity, and availability of data-at-rest are protected. |
PR.DS-01 |
The
confidentiality, integrity, and availability of data-at-rest are protected |
Ex1: Use encryption, digital signatures, and cryptographic
hashes to protect the confidentiality and integrity of stored data in files,
databases, virtual machine disk images, container images, and other resources |
|
PR.DS-P2 |
The
confidentiality, integrity, and availability of data-in-transit are
protected. |
PR.DS-02 |
The
confidentiality, integrity, and availability of data-in-transit are protected |
Ex1: Use encryption, digital signatures, and cryptographic
hashes to protect the confidentiality and integrity of network communications |
|
PR.DS-P3 |
Systems/products/services
and associated data are managed throughout their life cycle. |
ID.AM-08 |
Systems,
hardware, software, services, and data are managed throughout their life
cycles |
Ex1: Integrate cybersecurity considerations throughout the
life cycles of systems, hardware, software, and services |
|
PR.DS-P8 |
The
authenticity and integrity of hardware and software are assessed prior to
acquisition and use. |
ID.RA-09 |
The
authenticity and integrity of hardware and software are assessed prior to
acquisition and use |
Ex1: Assess the authenticity and cybersecurity of critical
technology products and services prior to acquisition and use |
|
PR.DS-P9 |
The
confidentiality, integrity, and availability of data-in-use are protected. |
|
|
|
|
PR.DS-P10 |
Backups
of data are created, protected, maintained, and tested. |
PR.DS-11 |
Backups
of data are created, protected, maintained, and tested |
Ex1: Continuously back up critical data in near-real-time,
and back up other data frequently at agreed-upon schedules |
|
PR.PS-P1 |
Configuration
management practices are established and applied. |
PR.PS-01 |
Configuration
management practices are established and applied |
Ex1: Establish, test, deploy, and maintain hardened
baselines that enforce the organization s cybersecurity policies and provide
only essential capabilities (i.e., principle of least functionality) |
|
PR.PS-P2 |
Software
is maintained, replaced, and removed commensurate with risk. |
PR.PS-02 |
Software
is maintained, replaced, and removed commensurate with risk |
Ex1: Perform routine and emergency patching within the
timeframes specified in the vulnerability management plan |
|
PR.PS-P3 |
Hardware
is maintained, replaced, and removed commensurate with risk. |
PR.PS-03 |
Hardware
is maintained, replaced, and removed commensurate with risk |
Ex1: Replace hardware when it lacks needed security
capabilities or when it cannot support software with needed security
capabilities |
|
PR.PS-P4 |
Installation
and execution of unauthorized software are prevented. |
PR.PS-05 |
Installation
and execution of unauthorized software are prevented |
Ex1: When risk warrants it, restrict software execution to
permitted products only or deny the execution of prohibited and unauthorized
software |
|
PR.IR-P1 |
Networks
and environments are protected from unauthorized logical access and usage. |
PR.IR-01 |
Networks
and environments are protected from unauthorized logical access and usage |
Ex1: Logically segment organization networks and cloud-based
platforms according to trust boundaries and platform types (e.g., IT, IoT,
OT, mobile, guests), and permit required communications only between segments |
|
PR.IR-P2 |
The
organization s technology assets, including associated data, are protected
from environmental threats. |
PR.IR-02 |
The
organization s technology assets are protected from environmental threats |
Ex1: Protect organizational equipment from known
environmental threats, such as flooding, fire, wind, and excessive heat and
humidity |
|
PR.IR-P3 |
Mechanisms
are implemented to achieve resilience requirements in normal and adverse
situations. |
PR.IR-03 |
Mechanisms
are implemented to achieve resilience requirements in normal and adverse
situations |
Ex1: Avoid single points of failure in systems and
infrastructure |
|
PR.IR-P4 |
Adequate
resource capacity to ensure availability is maintained. |
PR.IR-04 |
Adequate
resource capacity to ensure availability is maintained |
Ex1: Monitor usage of storage, power, compute, network
bandwidth, and other resources |