NIST Privacy Framework — IDENTIFY Function

NIST Privacy Framework — IDENTIFY Function

Overview

The IDENTIFY function in the NIST Privacy Framework (Version 1.0, January 2020) enables organizations to develop organizational understanding of privacy risk arising from data processing. This skill covers all four subcategories: Business Environment (ID.BE), Data Actions (ID.DA), Improvement (ID.IM), and Risk Assessment (ID.RA).

IDENTIFY Function Subcategories

ID.BE — Business Environment

Understanding the organization's mission, objectives, stakeholders, and activities to prioritize privacy risk management decisions.

ID.DA — Data Actions

Understanding the data actions the organization performs and associated privacy risks.

ID.IM — Improvement

Continuous improvement of privacy risk management.

ID.RA — Risk Assessment

Understanding and evaluating privacy risks.

Implementation Workflow

Phase 1: Inventory and Discovery (Weeks 1-4)

1. Stakeholder Identification: Identify all internal and external stakeholders involved in data processing
2. System Inventory: Catalog all systems, applications, and services that process personal data
3. Data Flow Mapping: Document how data moves through the organization from collection to deletion
4. Role Classification: Determine the organization's role (controller/processor) for each data processing activity

Phase 2: Data Action Analysis (Weeks 5-8)

1. Data Action Catalog: Document all data actions (collection, retention, logging, generation, disclosure, transfer)
2. Ownership Assignment: Assign data stewards for each data action category
3. Problematic Data Action Screening: Evaluate each data action against NIST's problematic data actions list
4. Impact Assessment: Score each problematic data action on likelihood and severity scales (1-5)

Phase 3: Risk Assessment (Weeks 9-12)

1. Risk Scoring: Calculate risk scores as Likelihood x Impact for each identified problematic data action
2. Risk Prioritization: Rank risks and identify those exceeding organizational risk tolerance
3. Response Planning: Select and document risk response strategies for each high-priority risk
4. Control Mapping: Map existing and planned controls to identified risks

Phase 4: Continuous Improvement (Ongoing)

1. Quarterly Reviews: Reassess risk landscape and update risk register
2. Incident Integration: Incorporate findings from privacy incidents into risk assessments
3. Regulatory Monitoring: Track changes in applicable privacy regulations
4. Metrics Tracking: Monitor key risk indicators and report to governance bodies

Control Mapping to Other Frameworks

Maturity Assessment

Level 1 — Initial

• Ad hoc privacy risk identification
• No formal inventory of data processing activities
• Reactive approach to privacy issues

Level 2 — Managed

• Basic data inventory exists
• Some data actions documented
• Risk assessments conducted periodically

Level 3 — Defined

• Comprehensive data processing inventory maintained
• All data actions cataloged with owners
• Structured risk assessment process in place

Level 4 — Quantitatively Managed

• Metrics-driven risk assessment
• Automated monitoring of data actions
• Quantitative risk scoring methodology

Level 5 — Optimizing

• Continuous improvement process embedded
• Predictive risk analytics
• Industry-leading privacy risk management practices

References

• NIST Privacy Framework Version 1.0 (January 16, 2020)
• NIST SP 800-37 Rev. 2 — Risk Management Framework
• NIST IR 8062 — An Introduction to Privacy Engineering and Risk Management in Federal Systems
• ISO/IEC 27701:2019 — Privacy Information Management