NIST provides guidance on how to bridge privacy, cyber-security processes

The highly anticipated release of NIST’s Privacy Framework followed a year of extensive engagement with stakeholders through a series of public workshops and roundtables on the challenges of protecting data privacy and how to develop guidelines to assist companies in addressing these challenges. As the Privacy Framework is still under development, NIST encourages the submission of comments through Oct. 24 (submission instructions can be found here).

“Our goal was to deliver a tool that could help organizations communicate better about privacy risks when designing and deploying products and services, provide more effective solutions that can lead to better privacy outcomes, and facilitate compliance with their legal obligations,” Naomi Lefkovitz, a senior privacy policy advisor at NIST, wrote in a blog post.

In developing the Privacy Framework, a major focus of discussion concentrated on the relationship between privacy and cyber-security, tackling such questions as how to align privacy risk management with cyber-security risk management, as well as within an organization’s broader enterprise risk portfolio; how to address the overlap between data security and privacy breaches in cost-effective and practical ways; and how NIST’s Cybersecurity Framework can play a role.

Like the NIST Cybersecurity Framework, the Privacy Framework is composed of three parts: core activities and outcomes, profiles, and implementation tiers. A description of each section is below.

Core activities and outcomes (‘the core’)

The core provides an increasingly granular set of activities and outcomes that enable an organizational dialogue about managing privacy risk. Five key functions make up the core: Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P, where the “-P” distinguishes privacy from cyber-security risk management activities. These five functions are broken down further into underlying categories and subcategories. They are not intended to be a checklist, but a guide.

Since NIST kicked off discussions in October 2018, the Privacy Framework has gone through some important changes, Lefkovitz explained on a recent Webinar. For example, based on stakeholder feedback around the importance of governance, NIST decided to break out some of the categories that were under the “Identify-P” function and elevate them into the newly added function, “Govern-P.” Additionally, the category of “awareness and training” that originally was in the “Protect-P” function was moved into the “Govern-P” function to make it an overall organizational governance exercise, she said.

Profiles 

The second component of the Privacy Framework is a selection of specific functions, categories, and subcategories from the core that companies are expected to prioritize to help it manage privacy risk. The focus here, as with NIST’s Cybersecurity Framework, is customization.

The selection of profiles should be based on organizational or industry-sector goals, legal and regulatory requirements, the company’s own risk management priorities, and the privacy needs of individuals. Those factors help determine what companies are currently doing and forecast where they need to be, according to Lefkovitz. NIST further provides two hypothetical use cases to improve understanding of the core and to demonstrate how the development of profiles can increase collaboration and dialogue across companies and support risk-based decisions.

Implementation tiers 

The third component is meant to support conversations around whether the company has sufficient resources and processes in place to manage privacy risk and achieve its target profile. When selecting tiers, NIST recommends that a company consider its current risk management practices; its data-processing systems, products, or services; legal and regulatory requirements; business objectives; organizational privacy values and individuals’ privacy needs; and organizational constraints.

The Privacy Framework describes four distinct tiers: Partial (Tier 1); Risk Informed (Tier 2); Repeatable (Tier 3); and Adaptive (Tier 4).

“Tiers do not represent maturity levels,” the Privacy Framework states. “Progression to higher tiers is appropriate when an organization’s processes or resources at its current tier are insufficient to help it manage its privacy risks.”

Companies should take further comfort in the fact that there is no right or wrong way to apply the Privacy Framework. While some companies may “choose to use the implementation tiers to articulate [their] envisioned privacy risk management processes,” NIST said in the framework, “another organization may already have robust privacy risk management processes but may use the core’s five functions to analyze and articulate any gaps. Alternatively, an organization seeking to establish a privacy program can use the core’s categories and subcategories as a reference.”

Privacy vs. cyber-security risks

One significant focus of discussion leading up to release of the preliminary draft of the Privacy Framework was how to align it with NIST’s Cybersecurity Framework and how the different functions can be used to manage these different sources of risk. The core of the Privacy Framework was purposely designed in such a way that companies have flexibility to use both frameworks cohesively.

While cyber-security risk management contributes to privacy risk management, privacy risk can still arise outside the scope of cyber-risk. NIST uses a Venn diagram (a mathematical illustration of the relationships among sets) to illustrate both the differences and overlap between the two risks, where privacy risk is associated with “the unintended consequences of data processing” on the one side and cyber-security risk is associated with “loss of confidentiality, integrity, or availability” of data on the other. Where these two risks overlap in is in the area of privacy breaches.

Companies can use the first four functions—Identify-P, Govern-P, Control-P, Communicate-P—to manage privacy risk arising from data processing, while the Protect-P function can help companies manage privacy risk associated with privacy breaches, along with the Detect, Respond, and Recover functions from the Cybersecurity Framework, Lefkovitz said. “That might work very well for organizations that are still maturing their privacy program or don’t necessarily have a close collaboration with the cyber-security team, and so it’s important for both sides to understand the privacy perspective of data protection,” she said.

Alternatively, as the framework suggests, “organizations could use all of the Cybersecurity Framework functions, in conjunction with Identify-P, Govern-P, Control-P, and Communicate-P, to collectively address privacy and cyber-security risks.”

Critical time

As with the Cybersecurity Framework, the Privacy Framework comes at a critical time, as privacy breaches proliferate and furthermore as regulators draw increasing attention to individual privacy rights under the EU’s General Data Protection Regulation (GDPR) and, in the United States, the California Consumer Privacy Act (CCPA).

Understanding the relationship between individual privacy risk, particularly arising from data processing activities, and the resulting impact imposed on a company—such as customer abandonment, non-compliance costs, harm to reputation or internal culture—can serve as an organizational driver in terms of how to allocate budget and resources to strengthen the privacy program. “We hope that will help bring privacy into parity with the other risks that organizations are trying to manage in their enterprise risk management portfolio,” Lefkovitz said.

Privacy executives say that shift is already taking place. “This is a business differentiator,” said SunTrust Chief Privacy Officer Ron Whitworth during last year’s kickoff workshop. “We’ve always tried to make that case as privacy professionals dating back many years; but I think we’re really seeing that now where the executives and boards are jumping in and saying, ‘This is a critical business issue. This is not a compliance exercise.’”

The Privacy Framework will help privacy and risk professionals have better conversations with regulators, executives, and boards by helping to frame conversations around what a best-practice privacy risk management program should like. “This is going to be hugely important, as much as it was in the cyber-security context,” Whitworth said. “This is going to help lift everybody up to a standard we all need to reach.”