Written and maintained by CASRAI Editorial Board
Last updated
The NIST Privacy Framework is a voluntary tool from the U.S. National Institute of Standards and Technology for managing privacy risk to individuals that arises from data processing. It is not a law, a certification or a checklist, and no organization is required to adopt it. Version 1.0 (16 January 2020) is the published edition; Version 1.1 is an Initial Public Draft, as described on NIST’s pages on 29 October 2026. What follows covers the part many summaries skip: how Profiles and Tiers are meant to be used, and what the 1.0 to 1.1 change covers.
What the NIST Privacy Framework is and who runs it
NIST publishes and maintains the framework. Its own description is “a tool to help organizations improve individuals’ privacy through enterprise risk management,” developed in collaboration with stakeholders. The 2020 document, NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0 (DOI 10.6028/NIST.CSWP.01162020), says it is intended to be widely usable by organizations of all sizes and agnostic to any particular technology, sector, law or jurisdiction.
Like the NIST Cybersecurity Framework, it has three parts: the Core, Profiles and Implementation Tiers.
Who can use it (eligibility)
Any organization. The official page describes no application, registration or approval step. Because the framework is law-agnostic, a university, hospital or research office can use it alongside whatever legal obligations already apply. Informative references in the framework map outside standards, laws and regulations to its outcomes, so it supports those obligations rather than replacing them.
What it requires: the Core, Profiles and Tiers
The Core and its five Functions
The Core is divided into Functions, Categories and Subcategories, where Subcategories are discrete outcomes. Version 1.0 defines five Functions:
| Function | Purpose, as defined in Version 1.0 |
|---|---|
| Identify-P | Develop the organizational understanding to manage privacy risk for individuals arising from data processing. |
| Govern-P | Develop and implement the organizational governance structure to enable an ongoing understanding of the organization’s risk management priorities that are informed by privacy risk. |
| Control-P | Enable organizations or individuals to manage data with sufficient granularity to manage privacy risks. |
| Communicate-P | Enable organizations and individuals to have a reliable understanding of, and engage in a dialogue about, how data are processed and the associated privacy risks. |
| Protect-P | Develop and implement appropriate data processing safeguards. This is where privacy and cybersecurity risk management overlap. |
The framework states that the Core is not a checklist of actions to perform. An organization selects the Subcategories that fit its own risks.
Profiles
A Profile is a selection of Functions, Categories and Subcategories from the Core that an organization has prioritized. A Current Profile records outcomes being achieved now; a Target Profile records desired outcomes. An organization may add its own Functions, Categories and Subcategories for unique risks, and may keep several Profiles for different business lines or processes.
Implementation Tiers
There are four Tiers: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). The document describes them as a progression, albeit not a compulsory one, and not every organization needs Tier 3 or 4.
Using it: the Ready, Set, Go steps
For building or improving a privacy program, Version 1.0 offers a simple three-phase model.
- Ready. Use Identify-P and Govern-P to review Categories and Subcategories and begin the Current and Target Profiles. Activities here include setting organizational privacy values and policies, expressing a risk tolerance and conducting privacy risk assessments.
- Set. Complete the Current Profile with the outcomes already achieved (noting partial achievement), complete the Target Profile, compare the two to find gaps, and create a prioritized action plan reflecting mission drivers, costs and benefits, and risks. Resource needs identified here can inform the choice of Tier.
- Go. Carry out the action plan and adjust current practices to reach the Target Profile.
The phases need not run in order. The framework notes that repeating Ready more often can improve the quality of privacy risk assessments, and that Profiles can be updated iteratively to track changing risks.
Version status and what Version 1.1 changes
| Item | Version 1.0 | Version 1.1 Initial Public Draft |
|---|---|---|
| Status on NIST’s pages, 29 October 2026 | Published | Draft |
| Date | 16 January 2020 | Released 14 April 2025 |
| Identifier | DOI 10.6028/NIST.CSWP.01162020 | DOI 10.6028/NIST.CSWP.40.ipd |
| Main changes | Original five Functions, Profiles, Tiers | Targeted Core revisions; aligned with Cybersecurity Framework 2.0 (February 2024); new Section 1.2.2 on AI and privacy risk; usage guidance moved from Section 3 to an online interactive FAQ |
NIST’s announcement said the draft keeps compatibility with Cybersecurity Framework 2.0, set a comment deadline of 13 June 2025, and planned a final version later. As described on the official page on 29 October 2026, the final Version 1.1 had not replaced 1.0 as the published edition. NIST also lists a “Mapping of PF 1.0 Core to PF 1.1 Core” for organizations that have already built Profiles on 1.0, plus a Resource Repository with crosswalks.
Common mistakes
- Treating the Core as a compliance checklist. The framework says it is not one; choose Subcategories by risk.
- Reading Tiers as a ladder everyone must climb. The progression is explicitly not compulsory.
- Calling it a regulation. It is voluntary and law-agnostic. Legal duties such as the HIPAA Privacy Rule remain separate.
- Skipping Identify-P and Govern-P. The Ready phase is built on them, and the Set phase draws on the risk tolerance and risk assessment results they produce.
- Confusing it with the AI Risk Management Framework. The Privacy Framework is a separate NIST document. See the CASRAI guide to the NIST Govern, Map, Measure, Manage functions for that one.
Related NIST frameworks and guidance
| Document | Relationship stated in NIST sources |
|---|---|
| Cybersecurity Framework | The Privacy Framework has the same three-part structure and is designed to be used together with it; Version 1.1 is aligned with CSF 2.0. An organization using both may develop integrated action plans. |
| NIST SP 800-37 Rev. 2 | Cited in the framework for its “Prepare” step, as related guidance for privacy risk management. |
For research institutions weighing related controls, CASRAI covers NIST SP 800-53 Rev. 5, NIST SP 800-171 for CUI in university research, differential privacy and data anonymisation in research.
FAQ
Is the NIST Privacy Framework mandatory?
No. NIST describes it as a voluntary tool. The framework describes itself as a tool, not a law or a certification.
Does it replace privacy laws?
No. It is agnostic to any particular law or jurisdiction, and uses informative references to relate its outcomes to laws, regulations and standards.
Is Version 1.1 final?
As described on NIST’s pages on 29 October 2026, Version 1.1 is an Initial Public Draft and Version 1.0 is the published edition.
How many Functions does it have?
Five in Version 1.0: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P.
Sources
- NIST, Privacy Framework (checked 29 October 2026).
- NIST, NIST Privacy Framework Version 1.0, 16 January 2020 (checked 29 October 2026).
- NIST, NIST Updates Privacy Framework, Tying It to Recent Cybersecurity Guidelines, 14 April 2025 (checked 29 October 2026).
