Data Privacy and Data Governance Will Be Top Business Priorities for 2021

As COVID-19 has introduced a more aggressive and evolving cyber threat landscape, the need for companies to develop the right infrastructure to mitigate cybersecurity risk is more important now than ever before.

As part of this risk, consumer demand for privacy and increased legal requirements are making privacy and security top concerns for organizations. Companies are still in the early stages of understanding, adopting and implementing data privacy requirements and programs that support their company security practices and culture. 

Building the right foundation to highly secure and protect your company includes several fundamentals that are critical to supporting the infrastructure from the ground up. The foundation should be built upon the National Institute for Standards and Technology privacy framework.

What’s in the NIST privacy framework?

The framework includes five new control families that are broken out into individual categories and subcategories. The five categories can be summarized as follows:

• Develop the understanding to effectively manage privacy risks.
• Create an internal culture and corporate structure to support risk management and data governance.
• Develop policies, procedures, and practices to effectively control and protect data.
• Provide communication channels for employees to ask questions and raise issues related to privacy and data management.
• Implement technical, administrative, and physical controls to protect and maintain the integrity of data.

How to Implement the Framework

NIST provides guidance on how to utilize the framework to either create a new privacy program or improve an existing one. The framework is broken into three steps.

• Ready: The first step is to create an understanding of the organization, its mission, and the overall business environment. This environment includes things like risk tolerance, legal requirements, et cetera. This step is covered by the Identify and Govern functions. It is important that organizations focus on creating clear guidelines and values that are communicated to the staff. As with security, effective implementation of this framework requires the support and efforts of all employees.
• Set: Once the foundation has been laid, the next step is to outline what categories and subcategories are already implemented, partially implemented, or not implemented at all. Informed by the values and requirements established in the first step organizations can better prioritize the remaining controls for implementation. The second step should result in a clear plan that outlines the status of all controls, and a prioritized schedule for implementing the remainder.
• Go: The last step is the actual implementation of the action plan. The plan should be highly customized to meet the specific needs of the organization. As controls are implemented the second step "Set" can and should be repeated to keep an updated list of category implementation. Reassessing the priorities is important because the business landscape or organizational structure may shift significantly and require more or different types of controls.

Once developed and implemented, business leaders should socialize the framework requirements and categories among relevant teams, so the company is effectively prepared to address them. Of course, for certain tasks like privacy assessments, data mapping exercises, or developing a plan of action, outside parties should be brought in to provide a holistic, honest, and realistic output. 

While privacy and security are key priorities for businesses, companies must create a balance across the two, both in funding and in focus. 

The NIST framework makes it easier to integrate privacy within your existing programs, assuming your security program is based upon or references NIST’s existing requirements.  

Utilizing a security-focused framework like NIST in combination with the privacy framework will help create a robust, well-rounded program that covers security, privacy, and general operations.

Zachary Curley is a consultant in the AT&T Cyber Security Solutions.