NIST unveils draft update to its privacy framework

The National Institute of Standards and Technology (NIST) has released the initial public draft of its Privacy Framework Version 1.1 (PFW 1.1), inviting stakeholders to submit comments by 13 June 2025.

This update aims to enhance the framework’s usability, align it with the recently revised Cybersecurity Framework 2.0 (CSF 2.0), and address emerging privacy risks, particularly those associated with artificial intelligence (AI).

Key enhancements in PFW 1.1

The draft introduces several significant changes:

• Realignment with CSF 2.0: The framework’s Core has been updated to mirror the structure of CSF 2.0, facilitating integrated management of privacy and cybersecurity risks.
• AI and Privacy Risk Management: A new section addresses the unique privacy challenges posed by AI technologies, such as data inference risks and algorithmic biases.
• Streamlined Usability: Guidance materials have been relocated to the NIST Privacy Framework website, providing interactive resources and FAQS to assist organisations in implementing the framework effectively.

Julie Chua, Director of NIST’s Applied Cybersecurity Division, described the update as ‘a modest but significant’ revision that maintains compatibility with CSF 2.0, enabling organisations to manage the full spectrum of privacy and cybersecurity risks.

Call for public input

NIST encourages stakeholders to review the draft and provide feedback on various aspects, including:

• The inclusion of implementation examples linked to the NIST Privacy Workforce Taxonomy.
• The handling of gaps in Subcategory Unique Identifiers resulting from Core restructuring.
• Suggestions for further streamlining the framework’s documentation and online resources.

Comments can be submitted via email to privacyframework@nist.gov. A comment template and additional information are available on the NIST Privacy Framework website.

Next steps

Following the public comment period, NIST will consider the feedback received and plans to release the final version of PFW 1.1 later this year.

For more details and to access the draft, visit the NIST Privacy Framework page.