NIST Privacy Framework

NIST Privacy Framework v1.0 - Identify-P, Govern-P, Control-P, Communicate-P, Protect-P functions.


Short name	NIST PF
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NIST PF

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for NIST PF.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for NIST PF and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NIST-PF-ID-IM-P` Inventory and Mapping	Systems, products, and services that process data must be inventoried and the data processing environment mapped, which for software systems means an enumerated inventory of the components performing the processing (NIST Privacy Framework v1.0, ID.IM-P)	Scan
`NIST-PF-ID-IM-P-COMP` Complete Inventory Records	Inventory and mapping outcomes are only usable for privacy risk assessment if each inventoried element is recorded with sufficient detail: at minimum a name and version for every software component (NIST Privacy Framework v1.0, ID.IM-P subcategories)	Scan
`NIST-PF-ID-DE-P` Data Processing Ecosystem Risk Management	Organizations must identify, assess, and manage privacy risks arising from third parties in the data processing ecosystem, which requires knowing the supplier of each component in the processing stack (NIST Privacy Framework v1.0, ID.DE-P)	Scan
`NIST-PF-PR-DS-P` Data Security	Data must be managed consistent with the organization's risk strategy to protect confidentiality, integrity, and availability, implying verifiable integrity of the software components handling the data (NIST Privacy Framework v1.0, PR.DS-P)	Scan
`NIST-PF-GV-PO-P` Governance Policies and Accountability	Organizational privacy values, policies, and roles must be established and communicated, which entails accountable, attributable records of who produced the technical documentation for processing systems (NIST Privacy Framework v1.0, GV.PO-P)	Scan
`NIST-PF-CM-AW-P` Data Processing Awareness and Communication	Organizations must enable reliable communication about data processing to internal and external stakeholders, which is supported by interoperable, machine-readable descriptions of the processing systems (NIST Privacy Framework v1.0, CM.AW-P)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`NIST-PF-ID.IM`	Identify: Inventory and Mapping
`NIST-PF-ID.BE`	Identify: Business Environment
`NIST-PF-ID.RA`	Identify: Risk Assessment
`NIST-PF-GV.PO`	Govern: Policies and Procedures
`NIST-PF-GV.RM`	Govern: Risk Management Strategy
`NIST-PF-GV.AT`	Govern: Awareness and Training
`NIST-PF-CT.DM`	Control: Data Management
`NIST-PF-CT.DP`	Control: Disassociated Processing
`NIST-PF-CM.AW`	Communicate: Awareness to Individuals
`NIST-PF-PR.AC`	Protect: Access Control
`NIST-PF-PR.DS`	Protect: Data Security
`NIST-PF-PR.MA`	Protect: Maintenance

Policy templates

Written for NIST PF:

Privacy Risk Assessment Procedure (NIST Privacy Framework)
Privacy Data Management Policy (NIST Privacy Framework Control-P)
Privacy Awareness and Individual Communication Policy (NIST PF Communicate-P)

And 22 from the standard set, adapted to NIST PF.