The National Institute of Standards and Technology has published a new draft of its Privacy Framework, or PFW, enabling organizations to manage privacy risks posed by personal data passing through IT systems.
The updated PFW is designed to address existing privacy risk management requirements, maintain alignment with the revised Cybersecurity Framework, or CSF, and enhance usability, NIST said Monday. Failure to manage such risks could affect individuals and society and potentially damage organizations’ brands, bottom lines and growth prospects, the agency noted.
Managing Privacy Risks
Julie Anne Chua, director of the NIST’s applied cybersecurity division, described the release as “a modest but significant update.” “The PFW can be used on its own to manage privacy risks, but we have also maintained its compatibility with CSF 2.0 so that organizations can use them together to manage the full spectrum of privacy and cybersecurity risks,” she explained.
Notable Changes to Draft PFW
The draft PFW includes targeted changes to its core structure for alignment with the latest CSF version and a new section on AI and privacy risk management. The updated framework also moved its guidelines to the web, enabling users to readily access an interactive FAQ page that delivers quick answers. To complement the FAQ section, NIST established a PFW Learning Center that offers quick-start guides in several languages and features a video discussing the draft updates.
NIST is soliciting public comments on the draft and will accept submissions until June 13.
Join the Potomac Officers Club’s 2025 Cyber Summit on May 15 to discover innovative cyber technologies for a secure and resilient public sector. Register now to attend this important event!
