NIST proposes privacy safeguards for federal IT

The privacy of personal information will be a routine part of the  catalog of security controls used to protect federal information and information systems if a draft version of such controls that the National Institute of Standards and Technology realeaed on July 20 is adopted.

The controls that would become a part of the basic security controls in the latest guidelines for the Federal Information Security Management Act.

Protecting personally identifiable information, whether in paper or electronic form, is a fundamental responsibility of agencies, the draft version of the new guidelines says.

The proposed privacy controls include administrative, technical, and physical safeguards and are included as a separate appendix in the latest version of NIST’s Security Controls for Federal Information Systems and Organizations (Special Publication 800-53 Revision 4).

The privacy guidelines have been released separately by NIST for public comment.


Related coverage:

Can government and industry solve the security/privacy equation?


“Information security and privacy are taking on new levels of importance in the public and private sectors,” the guidelines say. “Privacy, with respect to personally identifiable information, is a core value that can be achieved only with appropriate legislation, policies, and associated controls to ensure compliance with requirements,” it adds.

SP 800-53, now in revision 3, is a foundational document for FISMA compliance. The current version is a suite of publications released in 2009 and was a collaboration effort  between NIST, the military and intelligence communities to establish a standard set of security controls for all government systems, including national security systems. The document, with new privacy controls, is being updated and revision 4 is expected to be released in December.

The proposed controls in Appendix J would supplement security controls in Appendix F of 800-53, and provide a roadmap for identifying and implementing privacy controls over the PII life cycle for both electronic and paper records.

The publication emphasizes the relationship of privacy and security.

“Privacy and security controls in federal information systems, programs, and organizations are complementary and mutually reinforcing in trying to achieve the privacy and security objectives of organizations,” it says.

But although the two are complementary, they are separate. “Organizations cannot have effective privacy without a solid foundation of information security. However, privacy is more than security and confidentiality and includes the principles of transparency and notice and choice, for example,” the guideline say.

The objectives of the Privacy Appendix are:

  • To provide a structured set of controls based on international standards and best practices to help agencies meet federal regulatory requirements.
  • To establish a linkage and relationship between privacy and security controls where these requirements overlap.
  • To demonstrate the applicability of the NIST Risk Management Framework in the selection, implementation, assessment, and monitoring of privacy controls. 
  • And to promote closer cooperation between privacy and security officials in enforcing federal privacy requirements.

There is a similarity in the structure of the proposed privacy controls in Appendix J and the security controls in Appendix F, and the use of privacy plans in conjunction with security plans should help organizations select the appropriate set of controls to meet
mission and business requirements. NIST also plans to develop assessment for evaluating the effectiveness of the controls.

The privacy controls in Appendix J are being released for comment separately from the body of SP 800-53 because of the importance and special nature of the material, NIST announced. Comments should be sent by September 2 to  sec-cert@nist.gov.

About the Author

William Jackson is a Maryland-based freelance writer.

Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.