Law / Frameworks / Crosswalk / NIST Privacy Framework to NIST AI 600-1
The NIST Privacy Framework, mapped to the NIST Generative AI Profile
8 of NIST Privacy Framework's controls connect to 7 of NIST AI 600-1's through 99 laws in 67 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
- To
- NIST Generative AI Profile, July 2024 (NIST AI 600-1), National Institute of Standards and Technology
- See also
- NIST AI 600-1 to NIST Privacy Framework, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: nist-ai-600-1--nist-privacy-framework.csv · nist-ai-600-1--nist-privacy-framework.json
Not connected to the NIST AI 600-1: 92 of NIST Privacy Framework's controls
Short of 2 laws
The same duties reach these and a NIST AI 600-1 control, in fewer than 2 of the laws we track.
- ID.RA-P4 Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.: with GAI-RISK-04 through FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
No NIST AI 600-1 control on the same duties
Laws reach these, but no duty that reaches one of them also reaches a NIST AI 600-1 control.
- ID.IM-P2 Owners or operators (e.g., the organization or third parties such as service..., 2 laws
- ID.IM-P4 Data actions of the systems/products/services are inventoried., 37 laws
- ID.IM-P5 The purposes for the data actions are inventoried., 1 law
- ID.IM-P6 Data elements within the data actions are inventoried., 7 laws
- ID.IM-P7 The data processing environment is identified (e.g., geographic location, internal,..., 17 laws
- ID.BE-P1 The organization’s role(s) in the data processing ecosystem are identified and communicated., 3 laws
- ID.BE-P3 Systems/products/services that support organizational priorities are identified and..., 1 law
- ID.RA-P3 Potential problematic data actions and associated problems are identified., 5 laws
- ID.RA-P5 Risk responses are identified, prioritized, and implemented., 15 laws
- ID.DE-P1 Data processing ecosystem risk management policies, processes, and procedures are..., 1 law
- ID.DE-P2 Data processing ecosystem parties (e.g., service providers, customers, partners,..., 29 laws
- ID.DE-P3 Contracts with data processing ecosystem parties are used to implement appropriate..., 77 laws
- ID.DE-P5 Data processing ecosystem parties are routinely assessed using audits, test results,..., 7 laws
- GV.PO-P1 Organizational privacy values and policies (e.g., conditions on data processing such..., 98 laws
- GV.PO-P2 Processes to instill organizational privacy values within system/product/service..., 50 laws
- GV.PO-P3 Roles and responsibilities for the workforce are established with respect to privacy., 54 laws
- GV.PO-P4 Privacy roles and responsibilities are coordinated and aligned with third-party..., 10 laws
- GV.RM-P1 Risk management processes are established, managed, and agreed to by organizational..., 1 law
- GV.AT-P1 The workforce is informed and trained on its roles and responsibilities., 9 laws
- GV.AT-P3 Privacy personnel understand their roles and responsibilities., 1 law
- GV.MT-P1 Privacy risk is re-evaluated on an ongoing basis and as key factors, including the..., 2 laws
- GV.MT-P3 Policies, processes, and procedures for assessing compliance with legal requirements..., 16 laws
- GV.MT-P4 Policies, processes, and procedures for communicating progress on managing privacy..., 7 laws
- GV.MT-P5 Policies, processes, and procedures are established and in place to receive, analyze,..., 3 laws
- GV.MT-P6 Policies, processes, and procedures incorporate lessons learned from problematic data actions., 1 law
- GV.MT-P7 Policies, processes, and procedures for receiving, tracking, and responding to..., 32 laws
- CT.PO-P2 Policies, processes, and procedures for enabling data review, transfer, sharing or..., 233 laws
- CT.DM-P1 Data elements can be accessed for review., 69 laws
- CT.DM-P2 Data elements can be accessed for transmission or disclosure., 22 laws
- CT.DM-P3 Data elements can be accessed for alteration., 23 laws
- CT.DM-P4 Data elements can be accessed for deletion., 22 laws
- CT.DM-P5 Data are destroyed according to policy., 104 laws
- CT.DM-P6 Data are transmitted using standardized formats., 8 laws
- CT.DM-P7 Mechanisms for transmitting processing permissions and related data values with data..., 1 law
- CT.DM-P9 Technical measures implemented to manage data processing are tested and assessed., 2 laws
- CT.DP-P1 Data are processed to limit observability and linkability (e.g., data actions take..., 8 laws
- CT.DP-P2 Data are processed to limit the identification of individuals (e.g., de-identification..., 10 laws
- CT.DP-P4 System or device configurations permit selective collection or disclosure of data elements., 10 laws
- CT.DP-P5 Attribute references are substituted for attribute values., 1 law
- CM.PO-P1 Transparency policies, processes, and procedures for communicating data processing..., 2 laws
- CM.AW-P2 Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups)..., 1 law
- CM.AW-P3 System/product/service design enables data processing visibility., 13 laws
- CM.AW-P4 Records of data disclosures and sharing are maintained and can be accessed for review..., 12 laws
- CM.AW-P5 Data corrections or deletions can be communicated to individuals or organizations..., 54 laws
- CM.AW-P6 Data provenance and lineage are maintained and can be accessed for review or..., 2 laws
- CM.AW-P7 Impacted individuals and organizations are notified about a privacy breach or event., 243 laws
- CM.AW-P8 Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent..., 5 laws
- PR.PO-P1 A baseline configuration of information technology is created and maintained..., 1 law
- PR.PO-P2 Configuration change control processes are established and in place., 2 laws
- PR.PO-P3 Backups of information are conducted, maintained, and tested., 10 laws
- PR.PO-P5 Protection processes are improved., 7 laws
- PR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery plans..., 131 laws
- PR.PO-P8 Response and recovery plans are tested., 9 laws
- PR.PO-P9 Privacy procedures are included in human resources practices (e.g., deprovisioning,..., 14 laws
- PR.PO-P10 A vulnerability management plan is developed and implemented., 25 laws
- PR.AC-P1 Identities and credentials are issued, managed, verified, revoked, and audited for..., 6 laws
- PR.AC-P2 Physical access to data and devices is managed., 6 laws
- PR.AC-P4 Access permissions and authorizations are managed, incorporating the principles of..., 34 laws
- PR.AC-P5 Network integrity is protected (e.g., network segregation, network segmentation)., 2 laws
- PR.AC-P6 Individuals and devices are proofed and bound to credentials, and authenticated..., 11 laws
- PR.DS-P1 Data-at-rest are protected., 14 laws
- PR.DS-P2 Data-in-transit are protected., 21 laws
- PR.DS-P3 Systems/products/services and associated data are formally managed throughout removal,..., 3 laws
- PR.DS-P4 Adequate capacity to ensure availability is maintained., 1 law
- PR.DS-P5 Protections against data leaks are implemented., 153 laws
- PR.MA-P1 Maintenance and repair of organizational assets are performed and logged, with..., 1 law
- PR.PT-P1 Removable media is protected and its use restricted according to policy., 2 laws
- PR.PT-P2 The principle of least functionality is incorporated by configuring systems to provide..., 2 laws
- PR.PT-P3 Communications and control networks are protected., 1 law
- PR.PT-P4 Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve..., 6 laws
No law we track reaches these
No duty in the laws we track reaches these controls.
- ID.IM-P3 Categories of individuals (e.g., customers, employees or prospective employees,...
- ID.IM-P8 Data processing is mapped, illustrating the data actions and associated data elements...
- ID.BE-P2 Priorities for organizational mission, objectives, and activities are established and...
- ID.RA-P1 Contextual factors related to the systems/products/services and the data actions are...
- ID.DE-P4 Interoperability frameworks or similar multi-party approaches are used to manage data...
- GV.PO-P6 Governance and risk management policies, processes, and procedures address privacy risks.
- GV.RM-P2 Organizational risk tolerance is determined and clearly expressed.
- GV.RM-P3 The organization’s determination of risk tolerance is informed by its role(s) in the...
- GV.AT-P2 Senior executives understand their roles and responsibilities.
- GV.AT-P4 Third parties (e.g., service providers, customers, partners) understand their roles...
- GV.MT-P2 Privacy values, policies, and training are reviewed and any updates are communicated.
- CT.PO-P4 A data life cycle to manage data is aligned and implemented with the system...
- CT.DP-P3 Data are processed to limit the formulation of inferences about individuals’ behavior...
- CM.PO-P2 Roles and responsibilities (e.g., public relations) for communicating data processing...
- PR.PO-P4 Policy and regulations regarding the physical operating environment for organizational...
- PR.PO-P6 Effectiveness of protection technologies is shared.
- PR.AC-P3 Remote access is managed.
- PR.DS-P6 Integrity checking mechanisms are used to verify software, firmware, and information integrity.
- PR.DS-P7 The development and testing environment(s) are separate from the production environment.
- PR.DS-P8 Integrity checking mechanisms are used to verify hardware integrity.
- PR.MA-P2 Remote maintenance of organizational assets is approved, logged, and performed in a...
Lines of the news aggregation laws we track were not read against the NIST Privacy Framework, so none of them connects the two here (how each subject's lines were read).
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the NIST AI 600-1 through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:
| Laws on | Read against the NIST Privacy Framework |
|---|---|
| AI | such lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent |
| scraping | such lines on interception, monitoring, personal data and privacy |
| news aggregation | not read |
Every duty line in the AI and scraping laws we track has been read against the framework for its subject.