As of November 5, 2026, NIST Privacy Framework 1.1 is still a draft. NIST released the Initial Public Draft (NIST CSWP 40) on April 14, 2025, the public comment period closed on June 13, 2025, and NIST’s project page still lists the final version as coming soon. The draft realigns the framework’s Core with NIST CSF 2.0, makes targeted changes to the Govern and Protect Functions, and adds a section on AI and privacy risk management.
Key Takeaways
- The final version has not been published as of November 5, 2026; in January 2026 NIST said it was coming in 2026.
- The draft makes targeted changes to Version 1.0 rather than replacing it.
- The draft adds a section on AI and privacy risk management (Section 1.2.2).
- Its Core is realigned with the NIST CSF 2.0 Core in many places.
- NIST is separately developing a Data Governance and Management Profile.
Where Does NIST Privacy Framework 1.1 Stand Now?
As of November 5, 2026, the final NIST Privacy Framework 1.1 has not been published. The Initial Public Draft was released on April 14, 2025, following a June 18, 2024 concept paper and a June 25–26, 2024 workshop. The draft reflects an increasing urgency around harmonizing privacy, cybersecurity, and AI governance, as organizations grapple with the overlapping pressures of regulatory complexity, evolving data practices, and accelerating AI adoption.
What NIST has said about the update so far:
- Govern and Protect: the draft makes targeted changes to the Core, focused on the Govern and Protect Functions, some in response to five years of stakeholder feedback.
- AI and privacy risk: new Section 1.2.2 explains how AI and privacy risks relate and how the framework can help manage them.
- Guidance moved online: the guide to using the framework is now on the web as an interactive FAQ.
- Data Governance and Management Profile: a separate NIST project; in January 2026 NIST said it planned to release new material and host a virtual workshop during the year.
Because the changes are targeted, organizations already aligned with Version 1.0 will not need to start from scratch. NIST has published a mapping from the Privacy Framework 1.0 Core to the 1.1 draft Core to help with the transition.
Stay tuned: The public comment period on the draft closed on June 13, 2025. As of November 5, 2026, NIST has not yet published the final Version 1.1. Organizations can prepare by reviewing the current framework alongside the finalized NIST CSF 2.0 and AI RMF 1.0, and by following NIST’s Data Governance and Management Profile project.
Background to the NIST Privacy Framework
The National Institute of Standards and Technology (NIST) began updating the Privacy Framework to Version 1.1 in 2024, about four years after the original framework was released in January 2020, starting with a concept paper on June 18, 2024.
Initially introduced as The NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0, the framework has been instrumental in enhancing the privacy programs of numerous organizations. However, in response to recent developments in information technology, including the release of NIST’s AI Risk Management Framework (AI RMF) and the update of NIST’s Cybersecurity Framework (CSF) to Version 2.0, NIST set out to bring the framework up to speed.
Dylan Gilbert, a privacy policy advisor with the Privacy Engineering Program at NIST, emphasized the framework’s dynamic nature, stating, “The Privacy Framework is a ‘living’ tool meant to evolve to meet stakeholder needs, and the time has come to update to Version 1.1.” He further highlighted the initial framework’s alignment with the CSF, aiming to maintain this connection by incorporating appropriate adjustments based on the changes introduced in CSF 2.0.
The adjustment of the NIST Privacy Framework in response to new frameworks like the NIST’s AI Risk Management Framework (AI RMF) and the update to the NIST Cybersecurity Framework (CSF) to Version 2.0 will likely focus on several key areas to ensure alignment, coherence, and effectiveness across these frameworks. Below are the changes that were anticipated before the draft. NIST then released the Initial Public Draft of Privacy Framework 1.1 (NIST CSWP 40) on April 14, 2025; see the status section above for what it contains.
Possible Changes in the Anticipated NIST Privacy Framework
- Integration of AI and Emerging Technologies Considerations
With the proliferation of artificial intelligence (AI) and other emerging technologies, the updated Privacy Framework may incorporate guidance and considerations for managing privacy risks associated with collecting, processing, and using personal data in AI systems. This integration could involve addressing issues such as data bias, algorithmic transparency, data protection in machine learning models, and the ethical use of AI.
- Enhanced Cybersecurity-Privacy Nexus
Given the interplay between cybersecurity and privacy, the NIST Privacy Framework update may strengthen its alignment with the NIST Cybersecurity Framework (CSF) Version 2.0. This alignment could involve harmonizing terminology, frameworks, and methodologies to facilitate the coordinated management of privacy and cybersecurity risks within organizations. Additionally, the updated Privacy Framework may guide on incorporating privacy considerations into cybersecurity risk management processes and vice versa.
- Data Governance and Risk Management
Recognizing the foundational role of data governance in privacy and cybersecurity, the updated Privacy Framework may emphasize data governance principles, practices, and controls. This could include guidance on establishing data governance frameworks, data lifecycle management, data minimization, data quality, and accountability mechanisms to support adequate privacy and cybersecurity risk management.
- Enhanced Stakeholder Engagement and Collaboration
The updated Privacy Framework may emphasize stakeholder engagement, collaboration, and transparency to address the evolving privacy landscape and stakeholder needs. This could involve soliciting feedback from diverse stakeholders, including privacy professionals, cybersecurity experts, policymakers, industry representatives, and civil society organizations, to ensure the framework remains relevant, practical, and responsive to emerging challenges and opportunities.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
- Continuous Improvement and Adaptation
Like the NIST Cybersecurity Framework’s “living” approach, the updated Privacy Framework may adopt a constant improvement and adaptation mindset. This could involve regular reviews, updates, and revisions to reflect changes in technology, regulations, industry standards, and best practices related to privacy and data protection.
- Enhanced Support for NIST Frameworks Integration
Stakeholders need improved support in integrating NIST frameworks and resources, particularly in privacy, cybersecurity, AI, and the Internet of Things (IoT). Recognizing data governance as the cornerstone for organizations navigating the complexities of data utilization while mitigating associated risks, NIST plans to develop a Joint NIST Frameworks Data Governance Profile.
- Joining NIST Data Governance Framework
Through discussions with stakeholders, it became evident that a joint Profile for data governance could effectively demonstrate the complementary use of NIST frameworks and resources. NIST invites input from stakeholders regarding the proposed joint Profile and encourages suggestions on its structure and content. NIST has since released the Privacy Framework 1.1 draft (April 2025) and continues work on the Data Governance and Management Profile.
By consolidating insights and best practices across multiple frameworks, the joint Data Governance Profile will enable stakeholders to showcase their strategic alignment with NIST guidelines and standards.
The Relationship Between Cybersecurity and Privacy Risk
The relationship between cybersecurity and privacy risk is intrinsic and interconnected. Cybersecurity measures focus on safeguarding digital systems, networks, and data from unauthorized access, breaches, and cyber threats. These measures include implementing firewalls, encryption, access controls, and regular security updates.
On the other hand, privacy risk concerns protecting individuals’ data and ensuring compliance with privacy regulations. This involves managing data collection, processing, storage, and sharing practices to prevent unauthorized disclosure, misuse, or exploitation of personal information.
The overlap between cybersecurity and privacy risk lies in the fact that a breach in cybersecurity can directly lead to privacy violations. For example, if a hacker gains unauthorized access to a database containing sensitive personal information, it compromises the system’s security and exposes individuals’ privacy.
Moreover, many cybersecurity regulations and standards, such as GDPR and CCPA, include requirements related to privacy protection. These regulations mandate organizations to implement security measures to safeguard individuals’ data, thus intertwining cybersecurity and privacy concerns.
As we embark on these initiatives, the public is encouraged to contribute to shaping these frameworks and resources by emailing [email protected]. NIST remains committed to evolving alongside technological advancements and stakeholder needs, ensuring that our frameworks continue to serve as valuable tools in navigating the evolving landscape of privacy and cybersecurity.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
FAQs
1. Will NIST include implementation examples?
In the draft, NIST asked whether to add practical examples that connect workforce tasks to the updated Core functions. These examples will help organizations better understand how to implement the framework, particularly for teams that require more concrete guidance on roles and responsibilities.
2. Should Subcategory ID gaps be renumbered?
Some Subcategory identifiers in the draft are no longer sequential, due to changes that removed or shifted certain items. In the draft, NIST asked whether to leave these gaps as they are, in order to preserve continuity with Version 1.0, or to renumber them for a cleaner, easier-to-follow structure.
3. Should more content be moved online?
Section 3 of the framework has already been transitioned to a web-based format. In the draft, NIST asked whether other parts of the framework, like appendices and user guides, should also move online to improve usability and support interactive learning.
4. Does the draft align well with CSF 2.0?
A major goal of this update is to better align the Privacy Framework with the Cybersecurity Framework 2.0. The draft reflects shared structure and language, and NIST collected feedback on how well the two frameworks work together during the comment period that closed on June 13, 2025.
