<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

In recent weeks, the National Institute of Standards and Technology released their latest draft of the new privacy framework. The forthcoming privacy framework will join NIST’s wildly popular Cybersecurity Framework (CSF) as well as Risk Management Framework (RMF), and can’t come a minute too soon. Data privacy and protection has been a rising concern among a more technology literate consumer base and state legislation has already started to respond. With the deadline for European GDPR as well as the impending deadline for the California Consumer Privacy Act, we are only in the early stages of state laws mandating transparent and ethical management of personal data.

 This Is Only The Beginning

As we predicted, the CCPA is only the beginning of state-specific legislation around consumer privacy and data protection. The CCPA, modeled after Europe’s GDPR, applies to California residents specifically. Where the law diverges from GDPR, though, is in the sale of personal data - a pressing issue for California residents given the business models of the tech titans of Silicon Valley. The CCPA mandates that covered entities clearly show an “opt-out of sale” button for California residents to opt-out of data sales. 

While not the first state-specific cyber-related legislation, the CCPA is one of the first consumer privacy-focused legislations and certainly the most hotly contested given the regulation it could mean for Silicon Valley. We’ve discussed before, though, that a reactionary check-box approach to compliance will yield superfluous efforts and poor allocation of resources. In terms of data privacy, though, checkbox compliance is all we have so far.

Where’s The Consolidation 

The value of the NIST Cybersecurity Framework from a strategy perspective is that most US industry and state-specific requirements use the CSF as a foundation. In short, adopting the CSF will futureproof an organization and allow them to focus on risk-based thinking over constantly worrying about the next compliance requirement. However, to date, there is not a similar data privacy framework. The challenge here is now that we are facing a rise in new regulation on data privacy and the NIST privacy framework can be for privacy what the CSF is for security. Furthermore, as CyberSaint co-founder and Chief Product Officer Padraic O’Reilly discussed in his NIST’s Golden Trio Webinar - these frameworks (the CSF, privacy framework, and RMF) are designed to work together and layer on top of each other to support a holistic data security program.

Building On A Solid Foundation

An industry recognized gold-standard in itself, the NIST CSF has also served as the foundation for multiple industry-specific frameworks - the NYDFS 23 NYCRR 500 regulation for New York financial service organizations, the Department of Defense DFARS mandate for contractors, and the insurance industry’s Model Law that’s already being adopted by multiple states - all derive their framework and approach from the NIST CSF. Whether linked directly or indirectly to the CSF, adopting the backbone framework (in this case, the CSF) allows security teams to focus on any points of difference when a new regulation arises rather than reactively scrambling whenever a new state- or industry-specific compliance requirement arises.

What The Industry Needs

We are starting to see the groundswell of federal regulation in terms of data privacy and cybersecurity, however, the timeline is vague, to say the least. States can move more nimbly and as a result, we can expect to see more states develop their own regulation before there is a federal standard. For organizations that do business in multiple states (commonplace in the internet age), this onslaught of apparently different regulations will cause security teams to spin their tires. What the industry needs, is a gold-standard foundation for the data privacy element of strong data protection. We at CyberSaint see the NIST privacy framework as that standard, the determining factor of whether it will be that standard is how fast it becomes available. Over the coming months, we can expect NIST to collect comments and integrate into possibly a new draft or maybe a final version - if we see more state-specific laws passed in that time, the NIST privacy framework’s moment will pass. Regardless of whether it is NIST or another regulatory body, though, for the sake of US security teams we need a foundation to standardize on. 

You may also like

Compliance and Regulations for ...
on January 9, 2023

Compliance for many cybersecurity programs has been the cornerstone and the catalyst for why many programs exist in the first place. Since the rise of the information technology ...

Cyber Risk Quantification: Metrics ...
on January 6, 2023

Risk management is the new foundation for an information security program. Risk management, coupled with necessary compliance activities to support ongoing business operations, ...

Padraic O'Reilly
Cybersecurity Maturity Models You ...
on December 30, 2022

Cybercrime has forced businesses worldwide into paying billions of dollars yearly. As more of the population becomes dependent on technology, the fear of cyber attacks continues ...

Top 10 Risks in Cyber Security
on December 23, 2022

Increasing cyber security threats continue creating problems for companies and organizations, obliging them to defend their systems against cyber threats. According to research ...

Governance and Process Automation
on December 21, 2022

Any enterprise operating at scale understands the need for standardization and strong corporate governance. Having served Fortune 50 companies for decades, I have seen the ...

Jerry Layden
Introducing Crosswalking Templates
on December 19, 2022

Crosswalking can be a handy tool to view control performance for a single asset/system against multiple frameworks. One can complete an assessment using one framework by ...