Law / Frameworks / Crosswalk / NIST Privacy Framework to NIST CSF 2.0
The NIST Privacy Framework, mapped to the NIST Cybersecurity Framework
32 of NIST Privacy Framework's controls connect to 46 of NIST CSF 2.0's through 398 laws in 177 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
- To
- NIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), National Institute of Standards and Technology
- See also
- NIST CSF 2.0 to NIST Privacy Framework, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: nist-privacy-framework--nist-csf.csv · nist-privacy-framework--nist-csf.json
Not connected to the NIST CSF 2.0: 68 of NIST Privacy Framework's controls
Short of 2 laws
The same duties reach these and a NIST CSF 2.0 control, in fewer than 2 of the laws we track.
- ID.IM-P2 Owners or operators (e.g., the organization or third parties such as service...: with ID.AM-04 through DORA, Articles 28-30 (ICT Third-Party Risk Management), European Union
- ID.IM-P6 Data elements within the data actions are inventoried.: with ID.AM-07 through Data Classification Policy, Kuwait
- ID.BE-P3 Systems/products/services that support organizational priorities are identified and...: with ID.AM-05 and ID.RA-05 through Latvijas Bankas noteikumi Nr. 409, ICT Resilience Requirements Outside DORA, Latvia
- ID.RA-P4 Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.: with GV.RR-02 and ID.AM-01 through Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices, Greece; with PR.DS-01 through Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers, Luxembourg
- ID.DE-P1 Data processing ecosystem risk management policies, processes, and procedures are...: with GV.SC-01 through New York Department of Financial Services Cybersecurity Regulation, Third-Party Service Provider Security Policy, New York
- GV.PO-P4 Privacy roles and responsibilities are coordinated and aligned with third-party...: with ID.AM-08 through Ley 25.326, Ley de Protección de los Datos Personales, Argentina
- GV.MT-P3 Policies, processes, and procedures for assessing compliance with legal requirements...: with GV.RR-04 through Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens), Suriname; with ID.IM-01 through Privacy Protection Regulations (Data Security), information security programme, Israel
- GV.MT-P4 Policies, processes, and procedures for communicating progress on managing privacy...: with RS.CO-02 through Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, Cameroon
- GV.MT-P6 Policies, processes, and procedures incorporate lessons learned from problematic data actions.: with GV.PO-02 and RS.AN-08 through Ley para la Protección de Datos Personales, personal data breach notification, El Salvador
- CT.DM-P9 Technical measures implemented to manage data processing are tested and assessed.: with PR.DS-01 through Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Benin
- CT.DP-P2 Data are processed to limit the identification of individuals (e.g., de-identification...: with ID.AM-08 through Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data, Germany; with PR.DS-01 through Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules, Croatia
- CM.AW-P5 Data corrections or deletions can be communicated to individuals or organizations...: with ID.AM-08 through Personal Data Protection Proclamation, Ethiopia
- PR.PO-P1 A baseline configuration of information technology is created and maintained...: with PR.PS-01 through OSFI Guideline B-13, Technology and Cyber Risk Management, Canada
- PR.PO-P2 Configuration change control processes are established and in place.: with GV.SC-06, PR.PS-01 and PR.PS-06 through Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands
- PR.AC-P2 Physical access to data and devices is managed.: with PR.AA-06 through Law on Information Security, General Security Measures, Montenegro; with PR.DS-01 through Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures, Cabo Verde
- PR.DS-P4 Adequate capacity to ensure availability is maintained.: with PR.IR-04 through DORA, Articles 5-16 (ICT Risk Management Framework), European Union
- PR.MA-P1 Maintenance and repair of organizational assets are performed and logged, with...: with PR.PS-03 through Digital Code, Book VI: Critical Installation Protection and Operator Security Controls, Djibouti
- PR.PT-P1 Removable media is protected and its use restricted according to policy.: with PR.DS-01 and PR.DS-02 through Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield, Nevada
- PR.PT-P3 Communications and control networks are protected.: with PR.IR-01 and RS.CO-03 through Ley N° 18.331, Personal Data Protection and Habeas Data Law, Uruguay
No NIST CSF 2.0 control on the same duties
Laws reach these, but no duty that reaches one of them also reaches a NIST CSF 2.0 control.
- ID.IM-P5 The purposes for the data actions are inventoried., 1 law
- ID.IM-P7 The data processing environment is identified (e.g., geographic location, internal,..., 17 laws
- ID.BE-P1 The organization’s role(s) in the data processing ecosystem are identified and communicated., 3 laws
- ID.RA-P2 Data analytic inputs and outputs are identified and evaluated for bias., 8 laws
- ID.RA-P3 Potential problematic data actions and associated problems are identified., 5 laws
- ID.RA-P5 Risk responses are identified, prioritized, and implemented., 15 laws
- GV.RM-P1 Risk management processes are established, managed, and agreed to by organizational..., 1 law
- GV.AT-P3 Privacy personnel understand their roles and responsibilities., 1 law
- GV.MT-P1 Privacy risk is re-evaluated on an ongoing basis and as key factors, including the..., 2 laws
- GV.MT-P5 Policies, processes, and procedures are established and in place to receive, analyze,..., 3 laws
- GV.MT-P7 Policies, processes, and procedures for receiving, tracking, and responding to..., 32 laws
- CT.PO-P3 Policies, processes, and procedures for enabling individuals’ data processing..., 371 laws
- CT.DM-P1 Data elements can be accessed for review., 69 laws
- CT.DM-P2 Data elements can be accessed for transmission or disclosure., 22 laws
- CT.DM-P3 Data elements can be accessed for alteration., 23 laws
- CT.DM-P4 Data elements can be accessed for deletion., 22 laws
- CT.DM-P6 Data are transmitted using standardized formats., 8 laws
- CT.DM-P7 Mechanisms for transmitting processing permissions and related data values with data..., 1 law
- CT.DM-P10 Stakeholder privacy preferences are included in algorithmic design objectives and..., 78 laws
- CT.DP-P1 Data are processed to limit observability and linkability (e.g., data actions take..., 8 laws
- CT.DP-P4 System or device configurations permit selective collection or disclosure of data elements., 10 laws
- CT.DP-P5 Attribute references are substituted for attribute values., 1 law
- CM.PO-P1 Transparency policies, processes, and procedures for communicating data processing..., 2 laws
- CM.AW-P2 Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups)..., 1 law
- CM.AW-P3 System/product/service design enables data processing visibility., 13 laws
- CM.AW-P4 Records of data disclosures and sharing are maintained and can be accessed for review..., 12 laws
- CM.AW-P6 Data provenance and lineage are maintained and can be accessed for review or..., 2 laws
- CM.AW-P8 Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent..., 5 laws
No law we track reaches these
No duty in the laws we track reaches these controls.
- ID.IM-P3 Categories of individuals (e.g., customers, employees or prospective employees,...
- ID.IM-P8 Data processing is mapped, illustrating the data actions and associated data elements...
- ID.BE-P2 Priorities for organizational mission, objectives, and activities are established and...
- ID.RA-P1 Contextual factors related to the systems/products/services and the data actions are...
- ID.DE-P4 Interoperability frameworks or similar multi-party approaches are used to manage data...
- GV.PO-P6 Governance and risk management policies, processes, and procedures address privacy risks.
- GV.RM-P2 Organizational risk tolerance is determined and clearly expressed.
- GV.RM-P3 The organization’s determination of risk tolerance is informed by its role(s) in the...
- GV.AT-P2 Senior executives understand their roles and responsibilities.
- GV.AT-P4 Third parties (e.g., service providers, customers, partners) understand their roles...
- GV.MT-P2 Privacy values, policies, and training are reviewed and any updates are communicated.
- CT.PO-P4 A data life cycle to manage data is aligned and implemented with the system...
- CT.DP-P3 Data are processed to limit the formulation of inferences about individuals’ behavior...
- CM.PO-P2 Roles and responsibilities (e.g., public relations) for communicating data processing...
- PR.PO-P4 Policy and regulations regarding the physical operating environment for organizational...
- PR.PO-P6 Effectiveness of protection technologies is shared.
- PR.AC-P3 Remote access is managed.
- PR.DS-P6 Integrity checking mechanisms are used to verify software, firmware, and information integrity.
- PR.DS-P7 The development and testing environment(s) are separate from the production environment.
- PR.DS-P8 Integrity checking mechanisms are used to verify hardware integrity.
- PR.MA-P2 Remote maintenance of organizational assets is approved, logged, and performed in a...
Lines of the scraping and communications laws we track were not read against the NIST CSF 2.0, so none of them connects the two here (how each subject's lines were read).
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. Both are read line by line, so a line connects them only where it was read against both and placed on each. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:
| Laws on | Read against the NIST Privacy Framework | Read against the NIST CSF 2.0 |
|---|---|---|
| AI | such lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent | such lines on security, robustness, resilience, vulnerabilities and logs |
| scraping | such lines on interception, monitoring, personal data and privacy | not read |
| privacy | every line (their own framework) | such lines on breaches and incidents, security measures, encryption and pseudonymization, retention and disposal, and processor contracts |
| communications | every line (their own framework) | not read |
| age assurance | every line (their own framework) | every such line |
| cybersecurity | every such line | every line (their own framework) |
Every duty line in the AI, privacy, age assurance and cybersecurity laws we track has been read against the framework for its subject.