Manage privacy risk with the NIST PF, without the spreadsheets
The NIST Privacy Framework (NIST PF) is a voluntary framework from the US National Institute of Standards and Technology that helps organisations identify and manage privacy risk arising from how they process data. Version 1.0 was published in January 2020 and is built around a Core of five Functions, 18 Categories and 100 Subcategories. It is designed to sit alongside the NIST Cybersecurity Framework and to support compliance with privacy laws rather than replace them.
Is NIST PF right for your organisation?
No organisation is legally required to adopt the NIST Privacy Framework, but it is widely used by technology companies, public bodies and regulated businesses that want a common language for privacy risk. It is most useful when building a privacy programme from scratch, aligning privacy with an existing security programme, or showing customers and boards a structured approach to data protection obligations such as GDPR or US state privacy laws.
Adopting it is voluntary, though customers and auditors often expect it.
- Issued by
- National Institute of Standards and Technology (NIST), US Department of Commerce
- Version 1.0 published
- 16 January 2020
- Structure
- 5 Functions, 18 Categories, 100 Subcategories
- Requirement
- Voluntary, with no penalties for non-adoption
- Components
- Core, Profiles and Implementation Tiers
- Assessment route
- Self-assessment or third-party review; there is no official certification
- Next version
- Version 1.1, aligned with NIST CSF 2.0, released as a public draft in April 2025
- Type
- Framework (voluntary)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
The NIST Privacy Framework is mapped in OneClickComply's control library and is available on request, so you can track its Functions and Categories against the same controls you use for ISO 27001, SOC 2 or GDPR. Evidence collected once from your connected tools counts towards every framework it applies to, AutoComplete generates privacy and data handling policies from your real environment, and our in-house audit team can guide you through building your Target Profile.
Requirements covered
A Core of 5 Functions (Identify-P, Govern-P, Control-P, Communicate-P, Protect-P) containing 18 Categories and 100 Subcategories of privacy outcomes, used with Profiles and Implementation Tiers.
Manual NIST PF vs. OneClickComply
- Translating 100 Subcategories into practical controls by hand
- Keeping personal data inventories and data flow maps current in spreadsheets
- Writing privacy policies and procedures from blank templates
- Chasing screenshots and exports to show access and data security controls work
- Duplicating effort when GDPR, ISO 27701 or SOC 2 cover the same ground
- Framework outcomes mapped to controls so you know exactly what to implement
- Asset and system data pulled from connected tools to support your inventory
- Audit-ready policies generated from your real environment
- Evidence collected automatically from 13,000+ integrations
- Evidence collected once counts towards every framework it applies to
Everything you need for NIST PF
NIST PF Functions and Categories mapped to one shared control set
Data inventory and mapping support for Identify-P outcomes
AutoComplete privacy, retention and data handling policies
Automated evidence for Protect-P access and data security controls
Vendor risk management for your data processing ecosystem
Continuous monitoring with alerts when privacy controls drift
Three steps to NIST PF compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST PF and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST PF-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST Privacy Framework requirements
The 5 Functions and 18 Categories of the Privacy Framework 1.0 Core, which together contain 100 Subcategories.
| Reference | Requirement |
|---|---|
| ID-P | Identify-P |
| ID.IM-P | Inventory and Mapping |
| ID.BE-P | Business Environment |
| ID.RA-P | Risk Assessment |
| ID.DE-P | Data Processing Ecosystem Risk Management |
| GV-P | Govern-P |
| GV.PO-P | Governance Policies, Processes, and Procedures |
| GV.RM-P | Risk Management Strategy |
| GV.AT-P | Awareness and Training |
| GV.MT-P | Monitoring and Review |
| CT-P | Control-P |
| CT.PO-P | Data Processing Policies, Processes, and Procedures |
| CT.DM-P | Data Processing Management |
| CT.DP-P | Disassociated Processing |
| CM-P | Communicate-P |
| CM.PO-P | Communication Policies, Processes, and Procedures |
| CM.AW-P | Data Processing Awareness |
| PR-P | Protect-P |
| PR.PO-P | Data Protection Policies, Processes, and Procedures |
| PR.AC-P | Identity Management, Authentication, and Access Control |
Always check the official NIST PF text for the exact wording.
NIST PF FAQs
What is the NIST Privacy Framework?
The NIST Privacy Framework is a voluntary tool published by the US National Institute of Standards and Technology to help organisations identify and manage privacy risk. Version 1.0, released in January 2020, has three parts: the Core, a set of privacy outcomes in five Functions; Profiles, which describe current and target states; and Implementation Tiers, which describe how mature an organisation's privacy risk management is.
Is the NIST Privacy Framework mandatory?
No. The NIST Privacy Framework is voluntary and is not a law or regulation, so there are no fines for not adopting it. Organisations use it to structure their privacy programme and to demonstrate a risk-based approach. It can, however, help you meet legal obligations such as GDPR, the UK GDPR or US state privacy laws, which do carry penalties.
What are the five Functions of the NIST Privacy Framework?
The five Functions are Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. Identify-P builds understanding of data processing and privacy risk, Govern-P sets up the governance structure, Control-P manages data at a granular level, Communicate-P covers transparency with individuals and others, and Protect-P covers data security safeguards. Together they contain 18 Categories and 100 Subcategories.
How does the NIST Privacy Framework relate to the NIST Cybersecurity Framework?
The two frameworks are designed to be used together. Privacy risk and cybersecurity risk overlap where personal data is exposed through security incidents, and the Protect-P Function in the Privacy Framework was modelled on the Cybersecurity Framework's Protect Function. Organisations can use both to manage security and privacy risk with a shared structure and vocabulary.
How does the NIST Privacy Framework compare to GDPR and ISO 27701?
GDPR is a law with binding obligations and fines, while the NIST Privacy Framework is a voluntary, outcome-based framework. ISO/IEC 27701 is a certifiable privacy extension to ISO 27001. Many of their requirements overlap, such as data inventories, risk assessment and individual rights, so the NIST Privacy Framework can be used to organise a programme that also supports GDPR and ISO 27701 compliance.
Can you be certified against the NIST Privacy Framework?
No. NIST does not offer certification for the Privacy Framework, and there is no official accreditation scheme. Organisations typically perform a self-assessment by comparing a Current Profile against a Target Profile, sometimes supported by an independent third-party review. If you need a certificate, ISO/IEC 27701 is the common certifiable alternative for privacy management.
Is there a newer version than NIST Privacy Framework 1.0?
Yes, an update is in progress. NIST released the Privacy Framework 1.1 Initial Public Draft in April 2025, aligning its structure with NIST Cybersecurity Framework 2.0 and adding material on AI and privacy risk. Version 1.0 remains the published baseline until NIST issues the final 1.1, so check NIST's Privacy Framework page for the current status.
Does OneClickComply support the NIST Privacy Framework?
The NIST Privacy Framework is mapped in OneClickComply's control library and is available on request. That means its Functions and Categories can be tracked against the same controls you use for ISO 27001, SOC 2 or GDPR, with evidence collected once from your connected tools. Speak to our team to enable it and get guidance from our in-house auditors.
Related standards
All standards- NIST Cybersecurity Framework 2.0Framework · US
- NIST AI Risk Management Framework 1.0Framework · US
- NIST SP 800-218 Secure Software Development Framework (SSDF)Framework · US
- NIST SP 800-37 Rev. 2 (Risk Management Framework)Framework · US
- NIST SP 800-53 Rev. 5Standard · US
- NIST SP 800-82 Rev. 3Guidance · US
- NIST SP 800-53 Rev. 4Standard · US
- NIST SP 800-171A Rev. 3Guidance · US
Get NIST PF ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.