Revision in progress. Privacy Framework 1.1 initial public draft (CSWP 40, 2025-04-14) realigns the framework with CSF 2.0 and adds AI and privacy risk; comments closed 2025-06-13 and no final has been published.
Key concepts
The Privacy Framework has a Core of five functions (Identify-P, Govern-P, Control-P, Communicate-P, Protect-P), Profiles and Implementation Tiers, mirroring the CSF. It is neutral about technology, sector and law, so it complements obligations such as FERPA and state student privacy laws rather than replacing them.
How it is organized
- Core, Profiles and Implementation Tiers
- Functions: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P
- How to use it: informative references, accountability, privacy programs, system life cycle, data ecosystem, buying decisions
- Appendices: Core, glossary, privacy risk management practices, Tier definitions
What a school district should take from it
- Privacy risk comes from processing data, even when it is perfectly secure.
- A data inventory (what student data, where, shared with whom) underpins both privacy and security.
How to use it in your district
- Build a student and staff data inventory, starting with vendors that receive student data.
- Use the Communicate-P outcomes to shape what the district tells families about data use.
- Review new edtech purchases for data minimization and sharing, not only security.
- Assign an owner for privacy decisions at the cabinet level.
Common misconceptions
- Privacy is covered once data is encrypted.
- Privacy also concerns whether data should be collected, how it is used and who it is shared with.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- GV.POPolicy
- GV.RMRisk Management Strategy
- ID.AMAsset Management
- PR.DSData Security
Tools in the program portal
- Student data privacy agreementsTrack a signed agreement for every vendor that receives student data
- Guide: Vendor data privacy agreementsPublic guide
- Vendor RegistryKnow which vendors hold district data
- Policy BuilderDraft policy language tied to rubric categories
Related publications
- AI RMF 1.0 (NIST AI 100-1)AI Risk Management Framework
- CSF 2.0 (CSWP 29)Cybersecurity Framework 2.0
Citation and source
Privacy Framework 1.0 (CSWP 10), NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.CSWP.10.
Topics: Privacy and student data, Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.