nist-pf-control

NIST Privacy Framework — CONTROL Function

Overview

The CONTROL function develops and implements appropriate activities to enable organizations and individuals to manage data with sufficient granularity to manage privacy risks. It addresses data management, data processing governance, and disassociated processing techniques.

CONTROL Function Subcategories

CT.DM — Data Management

Policies and procedures for managing data throughout its lifecycle.

Subcategory	Description	Implementation Guidance
CT.DM-P1	Data elements can be accessed for review	Implement data subject access portals. Provide export in machine-readable formats (JSON, CSV). Response within regulatory timelines.
CT.DM-P2	Data elements can be accessed for transmission or disclosure	Support data portability requests. Implement secure transfer mechanisms. Maintain disclosure logs.
CT.DM-P3	Data elements can be accessed for alteration	Enable data correction workflows. Propagate corrections across all systems holding the data.
CT.DM-P4	Data elements can be accessed for deletion	Implement cascading deletion across primary and backup systems. Maintain deletion verification logs. Address data in analytics pipelines.
CT.DM-P5	Data processing activities are configured to meet the organization's data processing principles	Default to most privacy-protective settings. Implement purpose limitation at the system level.
CT.DM-P6	Retention schedules are established and in place	Define retention periods per data category. Implement automated purging. Document legal hold exceptions.
CT.DM-P7	Data are processed in accordance with established retention schedules	Automated enforcement of retention policies. Regular audits of data stores. Reporting on retention compliance.
CT.DM-P8	Integrity of data elements is maintained	Implement checksums and validation rules. Detect and resolve data quality issues. Track data lineage.
CT.DM-P9	Audit/log records are determined, documented, implemented, and reviewed	Privacy-specific audit logging for all data access and modifications. Log retention per regulatory requirements.
CT.DM-P10	Mechanisms for data subjects to authorize processing exist	Consent collection and management infrastructure. Granular consent options. Consent withdrawal capability.

CT.DP — Data Processing Policies and Procedures

Governance controls for data processing activities.

Subcategory	Description	Implementation Guidance
CT.DP-P1	Policies, processes, and procedures for authorizing data processing are maintained and enforced	Document lawful basis for each processing activity. Implement access controls aligned with authorized purposes.
CT.DP-P2	Data processing environment is identified, managed, and monitored	Maintain environment inventory (production, staging, development). Monitor for unauthorized processing. Separate test data from production data.
CT.DP-P3	Data processing procedures are maintained and monitored to meet established terms	Standard operating procedures for each processing type. Automated compliance checking. Exception management workflow.
CT.DP-P4	System or device configurations are set to authorized specifications	Secure configuration baselines for systems processing personal data. Configuration drift detection. Change management for privacy-relevant settings.
CT.DP-P5	Data processing activities are monitored and logged	Real-time monitoring of data processing operations. Anomaly detection for unusual processing patterns. Alerting for policy violations.

CT.PO — Disassociated Processing

Techniques to process data while minimizing identifiability.

Subcategory	Description	Implementation Guidance
CT.PO-P1	De-identification is applied to data elements to limit observability or linkability	Apply pseudonymization, anonymization, or generalization based on use case. Document de-identification methodology.
CT.PO-P2	Technical measures for disassociated processing are implemented	Deploy differential privacy, secure multi-party computation, or homomorphic encryption as appropriate. Select technique based on data utility requirements.

Data Management Architecture

Lifecycle Control Points

Collection --> Storage --> Processing --> Sharing --> Retention --> Deletion
    |            |           |             |            |            |
    v            v           v             v            v            v
 Consent     Encryption   Purpose      Access       Schedule    Cascading
 Capture     at Rest      Limitation   Controls     Enforcement  Purge
    |            |           |             |            |            |
    v            v           v             v            v            v
 Audit Log   Access Log   Process Log  Transfer Log Retention Log Deletion Log

Data Element Access Control Matrix

Operation	Data Subject	Data Steward	Processor	Analyst	Admin
View own data	Yes	Yes	No	No	Yes
Export own data	Yes	Yes	No	No	Yes
Correct own data	Request	Yes	No	No	Yes
Delete own data	Request	Yes	No	No	Yes
View aggregate	No	Yes	Yes	Yes	Yes
Process data	No	No	Yes	No	Yes
Analyze data	No	No	No	Yes	Yes
Configure system	No	No	No	No	Yes

Disassociated Processing Techniques

Technique Selection Guide

Technique	Identifiability Reduction	Data Utility	Computational Cost	Reversible
Pseudonymization	Medium	High	Low	Yes (with key)
k-Anonymity	Medium-High	Medium	Medium	No
l-Diversity	High	Medium	Medium	No
t-Closeness	High	Medium-Low	High	No
Differential Privacy	Very High	Medium	Medium	No
Data Masking	Low-Medium	Medium	Low	Depends
Generalization	Medium	Medium	Low	No
Suppression	High	Low	Low	No
Synthetic Data	Very High	Variable	High	No

De-identification Decision Framework

Is the data being shared externally?
├── Yes → Is re-identification risk acceptable?
│   ├── No → Apply formal anonymization (differential privacy, k-anonymity with k>=5)
│   └── Yes → Apply pseudonymization with contractual controls
└── No → Is the data used for analytics?
    ├── Yes → Apply aggregation or differential privacy
    └── No → Apply pseudonymization with access controls

Retention Schedule Template

Data Category	Retention Period	Legal Basis	Deletion Method	Verification
Customer transaction records	7 years from transaction	Tax/accounting regulations	Secure overwrite	Automated audit
Marketing consent records	Duration of consent + 3 years	Legitimate interest (proof)	Logical deletion	Annual review
Employee personnel files	Employment + 7 years	Employment law	Secure destruction	HR verification
Website analytics	26 months	Consent	Automated purge	Monthly check
Support tickets	3 years from resolution	Contract performance	Secure overwrite	Quarterly audit
CCTV footage	30 days	Legitimate interest	Automated overwrite	Weekly check
Backup tapes	90 days rolling	Business continuity	Tape degaussing	Quarterly audit

Audit Logging Requirements

Privacy-Specific Events to Log

Event Category	Specific Events	Required Fields
Data Access	View, export, download	User ID, timestamp, data subject ID, data elements accessed, purpose
Data Modification	Create, update, correct	User ID, timestamp, data subject ID, before/after values, purpose
Data Deletion	Delete, purge, anonymize	User ID, timestamp, data subject ID, deletion scope, verification
Consent Changes	Grant, withdraw, modify	Data subject ID, timestamp, consent scope, collection channel
Data Transfer	Internal transfer, external disclosure	User ID, timestamp, recipient, data elements, legal basis
Configuration	Access control changes, retention policy changes	Admin ID, timestamp, before/after settings, approval reference

Control Mapping

NIST PF CONTROL	ISO 27701	GDPR Article	NIST 800-53
CT.DM-P1	A.7.3.3	Art. 15	PM-25
CT.DM-P2	A.7.3.7	Art. 20	PM-25
CT.DM-P3	A.7.3.4	Art. 16	PM-25
CT.DM-P4	A.7.3.5	Art. 17	PM-25
CT.DM-P6	A.7.4.7	Art. 5(1)(e)	SI-12
CT.DM-P9	A.7.2.8	Art. 30	AU-2
CT.DM-P10	A.7.2.3	Art. 6, 7	IP-1
CT.DP-P1	A.7.2.2	Art. 6(1)	PT-3
CT.DP-P5	A.7.2.8	Art. 30	AU-6
CT.PO-P1	A.7.4.5	Art. 25(1)	PM-24
CT.PO-P2	A.7.4.5	Art. 25(1)	PM-24

References

• NIST Privacy Framework Version 1.0 (January 16, 2020)
• NIST SP 800-188 — De-Identifying Government Datasets
• NIST IR 8053 — De-Identification of Personal Information
• ISO/IEC 20889:2018 — Privacy Enhancing Data De-identification Techniques