The National Institute of Standards and Technology (NIST) has published the release version 1.0 of its privacy framework. The Framework is a voluntary tool that can be used by organizations to manage risks in compliance with privacy legislation, including the European GDPR.
The NIST Privacy Framework is designed to help organizations manage privacy risks, with specific focuses on:
The framework provides building blocks that help organizations in achieving privacy goals.
The Framework is composed of three main parts, the Core, Profiles, and Implementation Tiers.
The Core enables communications within organizations about privacy protection activities and desired goals. Profiles allow organizations to prioritize the outcomes and activities according to privacy values, the business mission, and risks.
Implementation tiers help organizations to optimize the resources that are necessary to manage the risk.
Organizations, one analyzed the potential impact of privacy risks, may choose to prioritize according to their strategy. The response to privacy risk includes:
The framework should also organizations to keep up with technology advancements and new uses for data.
“A class of personal data that we consider to be of low value today may have a whole new use in a couple of years, or you might have two classes of data that are not sensitive on their own, but if you put them together they suddenly may become sensitive as a unit,” said Naomi Lefkovitz, NIST privacy policy adviser who led the development of the framework. “That’s why you need a framework for privacy risk management, not just a checklist of tasks: You need an approach that allows you to continually reevaluate and adjust to new risks.”
The Privacy Framework is considered complementary with the NIST Cybersecurity Framework, using both it is possible to have a good understanding of the different origins of cybersecurity and privacy risks and allow to determine the most effective solutions to address the risks.
Additional details are included in the document titled “NIST PRIVACY FRAMEWORK: A TOOL FOR IMPROVING PRIVACY THROUGH ENTERPRISE RISK MANAGEMENT. “
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – privacy, NIST)
[adrotate banner=”5″]
[adrotate banner=”13″]
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Draytek VigorConnect and Kingsoft WPS Office bugs…
A critical flaw in the LiteSpeed Cache plugin for WordPress could allow unauthenticated users to…
Car rental giant Avis disclosed a data breach that impacted one of its business applications…
Recently fixed access control SonicOS vulnerability, tracked as CVE-2024-40766, is potentially exploited in attacks in the…
Apache addressed a remote code execution vulnerability affecting the Apache OFBiz open-source enterprise resource planning…
The United States and its allies state that Russia-linked threat actors operating under the GRU…
This website uses cookies.