Communications of the ACM
NIST Seeks Comments on Draft Privacy Risk Management Framework
Credit: iStockPhoto.com
Innovations in cloud computing, big data, and cyber-physical systems are bringing dramatic changes to the use of information technology. But while these technologies promise important benefits for the United States' economy, security, and quality of life, they pose an increasing risk to individual privacy.
To better anticipate and address the impacts these technologies can have on privacy in federal information systems, the National Institute of Standards and Technology (NIST) has drafted "Privacy Risk Management for Federal Information Systems," a document that lays out a framework for privacy risk management. NIST is asking for public comment on the draft framework.
"Risk management methods provide systematic ways to identify and address risk and have proven effective in areas such as cybersecurity, safety, and finance," says Naomi Lefkovitz, senior privacy policy advisor at NIST. "We see a great deal of potential for these methods to help agencies design and manage federal information systems that minimize risks to privacy."
The draft document supports such methods by providing a common vocabulary, objectives to facilitate privacy engineering, and a risk model for assessing privacy risk in information systems.
The privacy engineering objectives provide a conceptual framework for engineers and system designers to bridge the gap between high-level principles and implementation. The objectives are intended to support privacy risk management by facilitating consistent, actionable, and measurable design decisions. The privacy risk model aims to provide a repeatable and measurable method for addressing privacy risk in information systems.
In developing the draft Privacy Risk Management Framework, NIST sought the perspectives and experiences of privacy experts across a variety of sectors in an open and transparent process that included workshops, public comment periods, and various other outreach activities.
Future areas of work will focus on improving the application of policy, operational, and technical controls to mitigate risks identified with the Privacy Risk Management Framework. NIST will continue to request feedback from federal agencies, academic institutions, and other organizations to refine the privacy engineering objectives and the privacy risk model, and to develop additional guidance to assist agencies in determining the likelihood and impact of privacy risks.
Submit comments to [email protected] using the provided format. Collected input will be used to refine the framework. The period of public comment closes July 13, 2015, at 5 pm EDT.
No entries found