NIST Unveils Revamped Privacy Framework Aligned with Cybersecurity Advances

At a glance

• The National Institute of Standards and Technology (NIST) has updated its Privacy Framework to line up with its latest cybersecurity guidance.
• The draft keeps a risk-based approach that covers both privacy and security.
• Key updates include alignment with CSF 2.0, new guidance on AI privacy risks and easier use alongside other frameworks.
• Privacy and security professionals see the alignment as a practical improvement.

What NIST changed

The National Institute of Standards and Technology (NIST) has released an update to its Privacy Framework. The initial public draft of Privacy Framework 1.1, published on April 14, 2025, realigns the framework with NIST Cybersecurity Framework (CSF) 2.0. The aim is to make it easier for organizations to handle privacy and security risks together.

A risk-based approach at the core

Risk management remains the center of the framework. Organizations identify their privacy risks and manage them, and the updated structure fits more easily with the security processes they already run. The result is a plan matched to each organization’s specific privacy concerns.

Working with other frameworks

Interoperability is one of the main improvements. The draft uses the same structure as CSF 2.0, with a Core, Organizational Profiles and Tiers, so organizations that already use the widely adopted NIST Cybersecurity Framework can apply both side by side with less duplication.

Why practitioners welcome it

Privacy and security teams have largely welcomed the change, since it cuts redundant effort.

AI and new technology

New technology brings new privacy risks. The draft adds a section on managing privacy risks from artificial intelligence, such as inference attacks and the misuse of training data, and keeps the framework relevant to connected devices and other new tools.

International Collaboration and Standards

Privacy problems cross borders, and NIST works with international standards bodies to promote shared approaches. That helps organizations that have to meet rules in many different countries.

What it means for privacy teams

The updated Privacy Framework brings privacy and security work closer together. It keeps risk management at the core, fits better with CSF 2.0 and addresses AI. NIST took public comments on the draft through June 13, 2025, before finalizing it.

The update helps individual organizations, and it gives the wider privacy community a shared, practical standard.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.