Law / Frameworks / Crosswalk / NIST CSF 2.0 to NIST Privacy Framework
The NIST Cybersecurity Framework, mapped to the NIST Privacy Framework
46 of NIST CSF 2.0's controls connect to 32 of NIST Privacy Framework's through 398 laws in 177 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- NIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), National Institute of Standards and Technology
- To
- NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
- See also
- NIST Privacy Framework to NIST CSF 2.0, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: nist-privacy-framework--nist-csf.csv · nist-privacy-framework--nist-csf.json
Not connected to the NIST Privacy Framework: 60 of NIST CSF 2.0's controls
Short of 2 laws
The same duties reach these and a NIST Privacy Framework control, in fewer than 2 of the laws we track.
- GV.RR-03 Adequate resources are allocated commensurate with the cybersecurity risk strategy,...: with PR.PO-P7 through Digital Code, digital resilience baseline security measures, Kyrgyzstan
- GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and...: with GV.MT-P6 and PR.PO-P7 through Ley para la Protección de Datos Personales, personal data breach notification, El Salvador
- GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies,...: with ID.DE-P1 through New York Department of Financial Services Cybersecurity Regulation, Third-Party Service Provider Security Policy, New York
- GV.SC-08 Relevant suppliers and other third parties are included in incident planning,...: with PR.PO-P7 through OSFI Guideline B-10, Third-Party Risk Management, Canada
- ID.AM-01 Inventories of hardware managed by the organization are maintained: with ID.IM-P1 and ID.RA-P4 through Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece
- ID.AM-04 Inventories of services provided by suppliers are maintained: with ID.IM-P2 through DORA, Articles 28-30 (ICT Third-Party Risk Management), European Union
- ID.RA-03 Internal and external threats to the organization are identified and recorded: with ID.IM-P1 through DORA, Articles 5-16 (ICT Risk Management Framework), European Union; with PR.DS-P5 through Protection of Personal Information Act 4 of 2013 (POPIA), South Africa
- ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified...: with CM.AW-P7 through Tort Liability for Cybersecurity Programs, affirmative defense for a reasonable security program, Iowa; with PR.PO-P10 through EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate, European Union
- ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked: with PR.DS-P1 through New York Department of Financial Services Cybersecurity Regulation, Encryption of Nonpublic Information, New York
- PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions: with PR.AC-P1 through Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union
- PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk: with PR.AC-P2 through Law on Information Security, General Security Measures, Montenegro
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge...: with GV.AT-P1 and PR.DS-P5 through Data Protection Act, Saint Lucia; with PR.PO-P5 through Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union; with PR.PO-P7 through Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures, Latvia; with PR.PO-P10 through DORA, Articles 5-16 (ICT Risk Management Framework), European Union
- PR.PS-03 Hardware is maintained, replaced, and removed commensurate with risk: with PR.MA-P1 through Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti
- PR.PS-05 Installation and execution of unauthorized software are prevented: with PR.DS-P5 through DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
- PR.IR-04 Adequate resource capacity to ensure availability is maintained: with PR.PO-P7 through Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, European Union; with PR.DS-P4 through DORA, Articles 5-16 (ICT Risk Management Framework), European Union
- DE.AE-02 Potentially adverse events are analyzed to better understand associated activities: with PR.PO-P7 through Commission Implementing Regulation (EU) 2024/2690, Technical and Methodological Requirements for NIS2 Risk-Management Measures, European Union
- DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events: with CT.DM-P8 through New York Department of Financial Services Cybersecurity Regulation, Monitoring of Authorized Users and Cybersecurity Awareness Training, New York; with PR.AC-P1 and PR.AC-P4 through New York Department of Financial Services Cybersecurity Regulation, Access Privileges and Management, New York; with PR.DS-P5 through DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks, New York
- DE.CM-06 External service provider activities and services are monitored to find potentially...: with PR.PO-P7 through OSFI Guideline B-10, Third-Party Risk Management, Canada
- RS.MA-04 Incidents are escalated or elevated as needed: with PR.PO-P7 through DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents), European Union
- RS.AN-08 An incident's magnitude is estimated and validated: with GV.MT-P6 and PR.PO-P7 through Ley para la Protección de Datos Personales, personal data breach notification, El Salvador
- RC.CO-03 Recovery activities and progress in restoring operational capabilities are...: with PR.PT-P4 through DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment, New York
No NIST Privacy Framework control on the same duties
Laws reach these, but no duty that reaches one of them also reaches a NIST Privacy Framework control.
- GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on..., 1 law
- GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders, 1 law
- GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained, 3 laws
- GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk..., 1 law
- GV.RM-05 Lines of communication across the organization are established for cybersecurity..., 1 law
- GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing..., 7 laws
- GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage..., 1 law
- GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities..., 1 law
- ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to..., 4 laws
- DE.AE-06 Information on adverse events is provided to authorized staff and tools, 1 law
- DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis, 1 law
- DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria, 1 law
- RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related..., 3 laws
- RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging, 4 laws
No law we track reaches these
No duty in the laws we track reaches these controls.
- GV.OC-01 The organizational mission is understood and informs cybersecurity risk management
- GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations...
- GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood...
- GV.RM-04 Strategic direction that describes appropriate risk response options is established...
- GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in...
- GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust...
- GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are...
- GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and...
- GV.SC-04 Suppliers are known and prioritized by criticality
- GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk...
- ID.AM-03 Representations of the organization's authorized network communication and internal...
- ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources
- ID.RA-10 Critical suppliers are assessed prior to acquisition
- PR.AA-04 Identity assertions are protected, conveyed, and verified
- PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected
- PR.IR-02 The organization's technology assets are protected from environmental threats
- DE.AE-03 Information is correlated from multiple sources
- DE.AE-04 The estimated impact and scope of adverse events are understood
- DE.CM-02 The physical environment is monitored to find potentially adverse events
- RS.MA-05 The criteria for initiating incident recovery are applied
- RS.MI-02 Incidents are eradicated
- RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the...
- RC.RP-03 The integrity of backups and other restoration assets is verified before using them...
- RC.RP-04 Critical mission functions and cybersecurity risk management are considered to...
- RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and...
Lines of the scraping and communications laws we track were not read against the NIST CSF 2.0, so none of them connects the two here (how each subject's lines were read).
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. Both are read line by line, so a line connects them only where it was read against both and placed on each. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:
| Laws on | Read against the NIST CSF 2.0 | Read against the NIST Privacy Framework |
|---|---|---|
| AI | such lines on security, robustness, resilience, vulnerabilities and logs | such lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent |
| scraping | not read | such lines on interception, monitoring, personal data and privacy |
| privacy | such lines on breaches and incidents, security measures, encryption and pseudonymization, retention and disposal, and processor contracts | every line (their own framework) |
| communications | not read | every line (their own framework) |
| age assurance | every such line | every line (their own framework) |
| cybersecurity | every line (their own framework) | every such line |
Every duty line in the AI, privacy, age assurance and cybersecurity laws we track has been read against the framework for its subject.