<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

In recent weeks, the National Institute of Standards and Technology released their latest draft of the new privacy framework. The forthcoming privacy framework will join NIST’s wildly popular Cybersecurity Framework (CSF) as well as Risk Management Framework (RMF), and can’t come a minute too soon. Data privacy and protection has been a rising concern among a more technology literate consumer base and state legislation has already started to respond. With the deadline for European GDPR as well as the impending deadline for the California Consumer Privacy Act, we are only in the early stages of state laws mandating transparent and ethical management of personal data.

 This Is Only The Beginning

As we predicted, the CCPA is only the beginning of state-specific legislation around consumer privacy and data protection. The CCPA, modeled after Europe’s GDPR, applies to California residents specifically. Where the law diverges from GDPR, though, is in the sale of personal data - a pressing issue for California residents given the business models of the tech titans of Silicon Valley. The CCPA mandates that covered entities clearly show an “opt-out of sale” button for California residents to opt-out of data sales. 

While not the first state-specific cyber-related legislation, the CCPA is one of the first consumer privacy-focused legislations and certainly the most hotly contested given the regulation it could mean for Silicon Valley. We’ve discussed before, though, that a reactionary check-box approach to compliance will yield superfluous efforts and poor allocation of resources. In terms of data privacy, though, checkbox compliance is all we have so far.

Where’s The Consolidation 

The value of the NIST Cybersecurity Framework from a strategy perspective is that most US industry and state-specific requirements use the CSF as a foundation. In short, adopting the CSF will futureproof an organization and allow them to focus on risk-based thinking over constantly worrying about the next compliance requirement. However, to date, there is not a similar data privacy framework. The challenge here is now that we are facing a rise in new regulation on data privacy and the NIST privacy framework can be for privacy what the CSF is for security. Furthermore, as CyberSaint co-founder and Chief Product Officer Padraic O’Reilly discussed in his NIST’s Golden Trio Webinar - these frameworks (the CSF, privacy framework, and RMF) are designed to work together and layer on top of each other to support a holistic data security program.

Building On A Solid Foundation

An industry recognized gold-standard in itself, the NIST CSF has also served as the foundation for multiple industry-specific frameworks - the NYDFS 23 NYCRR 500 regulation for New York financial service organizations, the Department of Defense DFARS mandate for contractors, and the insurance industry’s Model Law that’s already being adopted by multiple states - all derive their framework and approach from the NIST CSF. Whether linked directly or indirectly to the CSF, adopting the backbone framework (in this case, the CSF) allows security teams to focus on any points of difference when a new regulation arises rather than reactively scrambling whenever a new state- or industry-specific compliance requirement arises.

What The Industry Needs

We are starting to see the groundswell of federal regulation in terms of data privacy and cybersecurity, however, the timeline is vague, to say the least. States can move more nimbly and as a result, we can expect to see more states develop their own regulation before there is a federal standard. For organizations that do business in multiple states (commonplace in the internet age), this onslaught of apparently different regulations will cause security teams to spin their tires. What the industry needs, is a gold-standard foundation for the data privacy element of strong data protection. We at CyberSaint see the NIST privacy framework as that standard, the determining factor of whether it will be that standard is how fast it becomes available. Over the coming months, we can expect NIST to collect comments and integrate into possibly a new draft or maybe a final version - if we see more state-specific laws passed in that time, the NIST privacy framework’s moment will pass. Regardless of whether it is NIST or another regulatory body, though, for the sake of US security teams we need a foundation to standardize on. 

You may also like

Informing Cyber Risk Management ...
on May 18, 2023

Cybersecurity is no longer just an IT issue but a business risk that can impact an organization's reputation, financial health, and legal compliance. Cybersecurity risks are ...

Is Your Organization Prepared for ...
on May 3, 2023

Data storage, as well as maintenance tools and applications, have undergone many iterations in the past decade, with the introduction of cloud computing and Security Information ...

Strategies for Automating a Cyber ...
on May 8, 2023

Cybersecurity leaders and teams are overburdened by several growing trends and issues. And when your cybersecurity team is overworked and unequipped to manage cyber risk ...

Selecting the Right Cyber Risk ...
on April 13, 2023

Cyber risk quantification is the process of determining the likelihood and potential impact of a cyber attack or security breach. The probability and impact will vary based on ...

Leveraging Cyber Security ...
on May 26, 2023

A common misunderstanding with cyber risk management is that only the CISO and security practitioners should be concerned about cyber and information security. Instead, the state ...

Tips and Tricks to Transform Your ...
on April 12, 2023

Simply being “cyber aware” is an unviable option for board members as the impact of cybersecurity expands beyond IT systems. An unnoticed security gap or dated risk assessment are ...