NIST Privacy Framework Guide (2026): Version 1.0, the 1.1 Draft and How to Use It

Who it applies to

• Any organization. The framework is sector- and technology-neutral, and it is voluntary for "any organization" (NIST).
• Typical users:
• US companies building a privacy program that spans several state laws
• organizations already using the NIST Cybersecurity Framework (CSF)
• vendors that need to describe their privacy posture to customers
• No legal force. NIST states that the contents "do not have the force and effect of law" (NIST).

Key requirements (framework structure)

Privacy risk model

The framework treats privacy risk as arising from data actions, meaning any operation on data. A problematic data action is one that could cause problems for individuals. Those problems include being surveilled, as well as cybersecurity-related privacy events such as theft or unauthorized employee access.

Impacts on individuals then translate into organizational impacts, such as noncompliance costs, customer loss and reputational harm. That lets privacy risk be managed alongside other enterprise risks (PF 1.0).

The five Functions (Core)

These are defined in PF 1.0:

• Identify-P. Build the organizational understanding needed to manage privacy risk. This covers data inventories, understanding individuals' privacy interests, and risk assessments.
• Govern-P. Set up the governance structure: privacy values and policies, legal and regulatory requirements, and risk tolerance.
• Control-P. Manage data with enough granularity to manage privacy risk, from the standpoint of both the organization and individuals.
• Communicate-P. Help organizations and individuals reliably understand, and talk about, how data is processed.
• Protect-P. Apply data processing safeguards against cybersecurity-related privacy events.

For security incidents, organizations can add the CSF's Detect, Respond and Recover Functions.

Categories in the 1.0 Core

Each Function breaks into Categories, which in turn break into Subcategories (specific outcomes). Version 1.0 has 18 Categories (PF 1.0):

• Identify-P: Inventory and Mapping (ID.IM-P), Business Environment (ID.BE-P), Risk Assessment (ID.RA-P) and Data Processing Ecosystem Risk Management (ID.DE-P).
• Govern-P: Governance Policies, Processes, and Procedures (GV.PO-P), Risk Management Strategy (GV.RM-P), Awareness and Training (GV.AT-P) and Monitoring and Review (GV.MT-P).
• Control-P: Data Processing Policies, Processes, and Procedures (CT.PO-P), Data Processing Management (CT.DM-P) and Disassociated Processing (CT.DP-P).
• Communicate-P: Communication Policies, Processes, and Procedures (CM.PO-P) and Data Processing Awareness (CM.AW-P).
• Protect-P: Data Protection Policies, Processes, and Procedures (PR.PO-P), Identity Management, Authentication, and Access Control (PR.AC-P), Data Security (PR.DS-P), Maintenance (PR.MA-P) and Protective Technology (PR.PT-P).

Appendix D lists preparatory resources that support privacy risk management. Among them are risk management role assignments (GV.PO-P3, GV.PO-P4), an enterprise risk management strategy (GV.RM-P), organization-level privacy requirements (GV.PO-P) and data maps (ID.IM-P). It notes that gaps in these resources should not stop teams from making the best risk decisions they can.

Profiles and Tiers

• Profiles. A Current Profile and a Target Profile pick out the Core outcomes an organization prioritizes, and the gap between them drives an action plan.
• Tiers. There are four: Partial (1), Risk Informed (2), Repeatable (3) and Adaptive (4). They describe how mature and well-resourced the organization's privacy risk management is (PF 1.0).

What 1.1 (draft) changes

According to the PF 1.1 IPD, the draft:

• makes targeted revisions to the Core and restructures it to realign with CSF 2.0
• adds a new Section 1.2.2 on AI and privacy risk management
• moves implementation guidance to the NIST website
• keeps the five Functions, and points users to CSF 2.0's Govern, Detect, Respond and Recover Functions for cybersecurity-related privacy events

On AI, the draft gives examples of the risks involved, such as training on data collected without consent and inference about individuals. It suggests tools like differentially private synthetic data to manage them.

Some subcategories have moved, which leaves gaps in the identifiers. For example, ID.RA-P2 has been withdrawn. NIST also provides a 1.0-to-1.1 Core mapping (NIST PF 1.1).

Certification process and timeline

There's no certification or attestation scheme. Organizations self-assess against Profiles. Some ask an independent assessor to evaluate their Target Profile, but NIST doesn't recognise any such scheme.

Penalties

None, because the framework is voluntary. However, the laws mapped to it, such as GDPR, CCPA and HIPAA, do carry penalties.

Mapping to related frameworks

• NIST CSF 2.0: designed to be used alongside it. The 1.1 draft realigns with CSF 2.0's structure.
• GDPR / UK GDPR / CCPA / LGPD: map legal requirements to Subcategories as informative references. NIST describes crosswalks as a way to "facilitate compliance" (PF 1.0).
• ISO/IEC 27701 and ISO/IEC 27001: a common certifiable counterpart.
• NIST AI RMF: use it with the 1.1 AI section for AI privacy risk.

Readiness checklist

1. Choose your baseline. Use 1.0 for stability, or the 1.1 draft if you're aligning with CSF 2.0 now, and plan to update when 1.1 is final.
2. Inventory your data actions, systems and data flows (Identify-P).
3. Document privacy values, policies and legal requirements (Govern-P).
4. Build a Current Profile by assessing each relevant Subcategory.
5. Define a Target Profile based on legal obligations, risk tolerance and business goals.
6. Pick a target Tier and analyse the gaps.
7. Build an action plan, with owners, for the Control-P and Communicate-P capabilities, such as preference management and transparency notices.
8. Coordinate Protect-P with your security program and CSF.
9. Reassess regularly, and whenever laws or products change.

Common pitfalls

• Claiming "NIST Privacy Framework certified". No such certification exists.
• Treating it as a security framework only. Control-P and Communicate-P cover non-security privacy risks.
• Building to 1.1 identifiers before the final release. IDs may still change.
• Not linking the framework to specific laws.

How AssureCore helps

• Cross-framework Mapping links Privacy Framework outcomes to GDPR, CCPA and ISO 27001 controls.
• The Controls Register and Risk Register track Profiles and privacy risks.
• Policy Management, with gap analysis, supports Govern-P.
• Action plans in the Evidence Hub track Target Profile gaps.

Frequently asked questions

Official references

• NIST – Privacy Framework home
• NIST – Privacy Framework Version 1.0
• NIST – Privacy Framework 1.0 (PDF)
• NIST – Privacy Framework 1.1 project page
• NIST – Privacy Framework 1.1 Initial Public Draft (PDF)
• NIST – Data Privacy Week 2026 blog

Related frameworks

• GDPR guide
• UK GDPR guide
• CCPA guide
• HIPAA guide