so at NIST we're working to develop the
privacy framework which we envision as a
voluntary tool for enterprise risk
management we've seen that it's a real
challenge for organizations to design
and operate technologies that are
mindful of diverse privacy needs and so
many of these technologies are fueled by
so much data so we think that the
privacy framework can help organizations
to consider how their systems products
and services affect individuals and
manage privacy risks so they can
optimize the beneficial uses of data
while minimizing adverse effects to
individuals privacy so we kicked off
this effort in October 2018 and it's
been a very collaborative approach with
stakeholders from across sectors there
are workshops public comment periods and
webinars everything is still in draft
form so we encourage feedback absolutely
as to where we work toward getting to
version 1.0 and so a few attributes of
the framework we've introduced that
we've heard a lot of support for the
framework is a risk-based its outcome
based and non-prescriptive which allows
it to be used by a variety of
organizations of different sizes in
different sectors with different mission
and business objectives the framework
has accessible language so it's usable
by not only privacy professionals but
non privacy professionals as well and
it's agnostic to any particular legal
regime so it can be used across
different jurisdictions the structure of
the privacy framework parallels that of
the cybersecurity framework because
we've heard from a lot of our
stakeholders they're interested in using
both in tandem and so this will
facilitate that process that said for
those who want to use the privacy
framework and don't intend to use a
cybersecurity framework it can
absolutely be used on its own too so
thanks to our engaging stakeholders
who've been giving us so much feedback
we're making good progress on developing
the framework and we're planning to
release it later this year