The NIST Privacy Framework is free to download and deliberately sits alongside the Cybersecurity Framework rather than inside any single privacy law. What it does not come with is the privacy risk management documentation a privacy programme has to produce against it.
On this page:
- Privacy Framework 1.1 is a draft, and this pack says so
- What is inside the privacy risk management documentation pack
- The Framework text ships inside the documents, lawfully
- Who the privacy risk management documentation pack is written for
- What the privacy risk management documentation pack does not do
- Frequently asked questions
- Related toolkits
Privacy Framework 1.1 is a draft, and this pack says so
Version 1.1 was published on 14 April 2025 as NIST CSWP 40 ipd. The comment period closed on 13 June 2025 and NIST has not announced a date for the final. PF 1.0, published 16 January 2020, remains the only final version. Anyone selling certification against either is selling something that does not exist, in any version.
That has three consequences and the pack is built around them rather than hiding them. Every document says aligned to PF 1.1 IPD and never uses the word compliant about the Framework itself. All 102 identifiers live in one data module, so if NIST renumbers them in the final draft – which its own Note to Reviewers raises – that is one edit and a rebuild rather than a rewrite of 145 files. And a PF 1.0 to PF 1.1 transition guide maps all 34 relocated identifiers and the 2 withdrawn ones, for organisations whose existing evidence points at identifiers that have moved.
The count is worth checking too. Text-search the source PDF for Subcategory identifiers and you will find 138: 102 active, 34 retired PF 1.0 identifiers carried only as pointers, and 2 withdrawn. This privacy risk management documentation covers the 102 that exist, lists the 34 that moved, and names the 2 withdrawn so you do not cover them by accident.
What is inside the privacy risk management documentation pack
145 editable templates – 108 Word documents and 37 Excel workbooks – covering all 102 active Subcategories across the Framework Functions, with 11 workbooks shipping pre-loaded.
- IDENTIFY-P – inventory and mapping, business environment, risk assessment and the data processing ecosystem risk management the Framework treats as central.
- GOVERN-P – governance policies, risk management strategy, awareness and training, and monitoring and review.
- CONTROL-P – data processing policies, the management of data elements themselves, and the mechanisms that give individuals control.
- COMMUNICATE-P – transparency policies and the data processing awareness records.
- PROTECT-P – the security controls the Framework shares with CSF, marked so you do not duplicate an existing ISMS.
- Privacy risk assessment – built on problematic data actions rather than on security impact, which is the distinction the whole Framework rests on.
- Profiles and Tiers – Current Profile, Target Profile and gap analysis, which is how the Framework is meant to be used in practice.
- Automated decision-making – including the Subcategory that speaks directly to it, which is the part most privacy programmes have no document for.
- Transition guide – all 34 relocated identifiers and the 2 withdrawn ones, for an organisation already running PF 1.0.
- Crosswalk – alignment with CSF 2.0, stated with its coverage on the face of it.
The Framework text ships inside the documents, lawfully
Every ISO toolkit has to paraphrase, because ISO requirement wording is copyright. This one does not have to. NIST Technical Series publications are works of the United States Government, NIST states that works authored by its employees are not subject to copyright protection within the United States, and it grants a royalty-free right to reprint them in derivative works subject to attribution.
So each of the 108 Word documents opens with a Framework outcomes addressed table carrying the Subcategory identifier, its Category and the outcome text in full. You can hand any single document to an assessor and they can see exactly which outcomes it evidences without holding the Framework open beside it. That is a material difference in how this privacy risk management documentation is read.
The idea the whole Framework rests on is that a privacy risk is not a security risk. A problematic data action can arise from processing that is entirely secure and entirely authorised – and an information security management system, however good, will not surface it. The risk assessment templates here are built on that distinction rather than on a relabelled security risk method.
Who the privacy risk management documentation pack is written for
- Privacy programmes that have been asked to show a framework rather than a policy set.
- Organisations already aligned to CSF 2.0 that need the privacy half without duplicating the security half.
- US federal contractors and their suppliers, where the Framework is the common reference point.
- Teams running PF 1.0 today who need the transition mapped rather than guessed.
What the privacy risk management documentation pack does not do
It does not certify you. No certification against the Privacy Framework exists, in version 1.0 or 1.1.
It is not a law-specific compliance pack. If you need GDPR, UK GDPR, CCPA or PDPL obligations met, those are separate regimes with separate documents.
It does not claim the draft binds. Where 1.1 differs from 1.0 the document says which it is following, because stating draft content as settled is wrong on the day the final lands.
Frequently asked questions
Should we wait for the final version?
Most organisations do not. The Functions and the overwhelming majority of outcomes are stable, the identifiers live in one module so a renumber is cheap, and the transition guide already handles movement between versions.
Is this the same as the Cybersecurity Framework pack?
No. They are designed to sit together and the crosswalk shows where they meet, but the privacy risk method is different and this pack is built on it.
Why 102 Subcategories?
Because 34 of the 138 identifiers in the document are retired PF 1.0 pointers and 2 are withdrawn. 102 are active.
What formats are the files in?
Native Microsoft Word and Excel, fully editable, no macros required.
Related toolkits
It is usually bought with the NIST CSF toolkit, and organisations that need a certifiable privacy management system add the ISO 27701 toolkit. For US state law obligations see the CCPA and CPRA toolkit. The Framework itself is free from nist.gov/privacy-framework.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
The privacy risk management documentation pack downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is locked, nothing is a PDF you cannot edit, and no add-on or portal login is needed to open it. Every organisation-specific value is marked as a placeholder so you can see what still has to be decided.
One payment, no subscription and no annual renewal. The source files behind the privacy risk management documentation pack are yours to adapt for your own organisation for as long as you need them, including future revisions of your own documents.
Reviews
There are no reviews yet.