Lion Cipher Lab

Build a NIST Privacy Framework profile: turn privacy risk into a prioritized plan

• GRC / Compliance
• Advanced
• ~90 min
• Free · no account required

Why it matters

Most privacy failures that reach the news are not break-ins. They are a fitness app selling location traces to data brokers, a 'free' service quietly inferring pregnancy or a health condition from shopping patterns, a children's product retaining data forever, an analytics SDK phoning home data the user never expected to leave the phone. In every one of those, the data was often perfectly SECURE — encrypted, access-controlled, un-breached — and the harm came from the PROCESSING ITSELF: what was collected, how it was used, who it was shared with, how long it was kept. That is the gap classic…

What you'll learn

• framing privacy risk the NIST Privacy Framework (PF) way — separating the part that overlaps cybersecurity risk (the security of personal data) from the PF's unique concern: privacy risk that arises from the authorized data PROCESSING itself, even when security is perfect
• using the NISTIR 8062 privacy risk model — identifying PROBLEMATIC DATA ACTIONS and rating the risk to individuals as likelihood x impact of the resulting problem, rather than confidentiality/integrity/availability of a system
• reading the PF CORE fluently: the five Functions (IDENTIFY-P, GOVERN-P, CONTROL-P, COMMUNICATE-P, PROTECT-P), their Categories and Subcategories, and how PROTECT-P deliberately overlaps the Cybersecurity Framework
• building a data-processing inventory / data map for a real scenario and running a privacy risk assessment on it
• constructing a CURRENT Profile and a TARGET Profile from selected PF Subcategories, and selecting an Implementation Tier (1-4) that reflects how rigorous and repeatable the privacy program actually is
• writing a prioritized action plan that closes the Current->Target delta, mapped to specific PF Subcategories — a real gap list, not a vague roadmap
• placing the PF correctly against neighboring practices: it is NOT a DPIA/ROPA (GDPR compliance records), NOT LINDDUN (privacy threat modeling), and NOT a legal compliance checklist — it is a voluntary, outcome-based risk-management framework that COMPLEMENTS all of those
• explaining when to reach for the PF, how it plugs into the CSF and an existing GRC program, and the trap of treating a risk framework as a checklist

Steps in this lab

1. The scenario, and the artifact you will produce
2. Part 1 — Frame privacy risk the PF way (and why it is not just security)
3. Part 2 — The PF Core: five Functions, and where it meets the CSF
4. Part 2b — GOVERN-P: set the privacy risk tolerance that steers everything
5. Part 3a — Build the data-processing inventory / data map
6. Part 3b — Privacy risk assessment: rate the problematic data actions
7. Part 4a — Build the Current Profile and Target Profile
8. Part 4b — Pick an Implementation Tier and write the prioritized action plan
9. The judgment: when to reach for the PF, how it plugs in, and the checklist trap

Open the full interactive lab →