NIST proposes privacy safeguards for federal IT

The privacy of personal information will be a routine part of the  catalog of security controls used to protect federal information and information systems if a draft version of such controls that the National Institute of Standards and Technology realeaed on July 20 is adopted.

The controls that would become a part of the basic security controls in the latest guidelines for the Federal Information Security Management Act.

Protecting personally identifiable information, whether in paper or electronic form, is a fundamental responsibility of agencies, the draft version of the new guidelines says.

The proposed privacy controls include administrative, technical, and physical safeguards and are included as a separate appendix in the latest version of NIST’s Security Controls for Federal Information Systems and Organizations (Special Publication 800-53 Revision 4).

The privacy guidelines have been released separately by NIST for public comment.

Related coverage:

Can government and industry solve the security/privacy equation?

“Information security and privacy are taking on new levels of importance in the public and private sectors,” the guidelines say. “Privacy, with respect to personally identifiable information, is a core value that can be achieved only with appropriate legislation, policies, and associated controls to ensure compliance with requirements,” it adds.

SP 800-53, now in revision 3, is a foundational document for FISMA compliance. The current version is a suite of publications released in 2009 and was a collaboration effort  between NIST, the military and intelligence communities to establish a standard set of security controls for all government systems, including national security systems. The document, with new privacy controls, is being updated and revision 4 is expected to be released in December.

The proposed controls in Appendix J would supplement security controls in Appendix F of 800-53, and provide a roadmap for identifying and implementing privacy controls over the PII life cycle for both electronic and paper records.

The publication emphasizes the relationship of privacy and security.

“Privacy and security controls in federal information systems, programs, and organizations are complementary and mutually reinforcing in trying to achieve the privacy and security objectives of organizations,” it says.

But although the two are complementary, they are separate. “Organizations cannot have effective privacy without a solid foundation of information security. However, privacy is more than security and confidentiality and includes the principles of transparency and notice and choice, for example,” the guideline say.

The objectives of the Privacy Appendix are:

• To provide a structured set of controls based on international standards and best practices to help agencies meet federal regulatory requirements.
  
• To establish a linkage and relationship between privacy and security controls where these requirements overlap.
  
• To demonstrate the applicability of the NIST Risk Management Framework in the selection, implementation, assessment, and monitoring of privacy controls. 
  
• And to promote closer cooperation between privacy and security officials in enforcing federal privacy requirements.

There is a similarity in the structure of the proposed privacy controls in Appendix J and the security controls in Appendix F, and the use of privacy plans in conjunction with security plans should help organizations select the appropriate set of controls to meet
mission and business requirements. NIST also plans to develop assessment for evaluating the effectiveness of the controls.

The privacy controls in Appendix J are being released for comment separately from the body of SP 800-53 because of the importance and special nature of the material, NIST announced. Comments should be sent by September 2 to  sec-cert@nist.gov.