In this episode of Privacy Abbreviated, hosts Dona Fraser, the SVP of Privacy Initiatives for BBB National Programs, and Jason Cronk, the President of the Institute of Operational Privacy Design, are joined by two guests to discuss the NIST Privacy Framework, developed by the National Institute of Standards and Technology (NIST). Listeners are invited to welcome Dylan Gilbert, a Privacy Policy Advisor with the Privacy Engineering Program at NIST, and Nandita Narla, the Head of Technical Privacy & Governance at Doordash.
The NIST Privacy Framework offers organizations a voluntary and adaptable set of guidelines and best practices for effectively managing privacy risks. Its flexible approach enables customization to suit an organization’s specific needs, helping to identify and manage privacy risks while fostering innovation and safeguarding individuals’ privacy.
11:35 – During the discussion, Nandita highlights the significance of the framework’s crosswalks, which startups often use to meet compliance requirements. Dylan later explains that crosswalks are mappings between various laws or regulations and the NIST Privacy Framework, aiding organizations in implementing the framework effectively.
Crosswalks offer a consolidated view of regulatory requirements, which can be beneficial for organizations operating in diverse jurisdictions or industries with varying compliance obligations. By aligning multiple regulations with a unified framework, organizations can identify areas of compliance overlap, gaps, or inconsistencies, guiding their compliance strategies and promoting integrated and efficient programs.
22:17 – Throughout the episode, Dylan emphasizes the many resources provided by NIST, such as the research repository and the appendices. He encourages listeners to utilize these free tools in conjunction with the core privacy framework by highlighting their guidance, best practices, and support during implementation.
The repository is a collection of crosswalks, common profiles, and guidelines designed to provide organizations with the knowledge needed to customize their approach to data privacy. Common profiles are sets of specific privacy controls or requirements tailored to address the needs and characteristics of different types of organizations or sectors. This type of tool supports organizations in taking control of privacy customization, efficiency, and risk management by providing examples of frameworks specific to a particular industry, sector, or organizational context.
Appendix D, which Dylan mentioned specifically, offers guidance around privacy risk management practices. Topics include organizing preparatory resources, assigning risk management roles, and identifying key stakeholders. It also guides decision-makers in determining the capabilities of an organization’s potential privacy structure.
Though the privacy framework and the additional tools NIST offers can serve as a guide to help organizations meet compliance guidelines, both the hosts and the guests repeatedly encourage listeners to think of it as more than a checklist. It’s an opportunity to challenge existing views on privacy and integrate security into every aspect of an organization.
In fact, Jason and Dona wrap up the episode by urging organizations to step away from siloed approaches to privacy and open their eyes to its pervasive influence across all activities and engagements. A comprehensive commitment to privacy requires the involvement of every individual within the organization.
Check out NIST’s Learning Center for videos and other resources that provide more information about the NIST privacy framework.
Visit to Learn More: NAD FAQs
Contact Information: programs@bbbnp.org
Listen to the full episode here.