NIST Privacy Framework — CONTROL Function
Overview
The CONTROL function develops and implements appropriate activities to enable organizations and individuals to manage data with sufficient granularity to manage privacy risks. It addresses data management, data processing governance, and disassociated processing techniques.
CONTROL Function Subcategories
CT.DM — Data Management
Policies and procedures for managing data throughout its lifecycle.
| Subcategory |
Description |
Implementation Guidance |
| CT.DM-P1 |
Data elements can be accessed for review |
Implement data subject access portals. Provide export in machine-readable formats (JSON, CSV). Response within regulatory timelines. |
| CT.DM-P2 |
Data elements can be accessed for transmission or disclosure |
Support data portability requests. Implement secure transfer mechanisms. Maintain disclosure logs. |
| CT.DM-P3 |
Data elements can be accessed for alteration |
Enable data correction workflows. Propagate corrections across all systems holding the data. |
| CT.DM-P4 |
Data elements can be accessed for deletion |
Implement cascading deletion across primary and backup systems. Maintain deletion verification logs. Address data in analytics pipelines. |
| CT.DM-P5 |
Data processing activities are configured to meet the organization's data processing principles |
Default to most privacy-protective settings. Implement purpose limitation at the system level. |
| CT.DM-P6 |
Retention schedules are established and in place |
Define retention periods per data category. Implement automated purging. Document legal hold exceptions. |
| CT.DM-P7 |
Data are processed in accordance with established retention schedules |
Automated enforcement of retention policies. Regular audits of data stores. Reporting on retention compliance. |
| CT.DM-P8 |
Integrity of data elements is maintained |
Implement checksums and validation rules. Detect and resolve data quality issues. Track data lineage. |
| CT.DM-P9 |
Audit/log records are determined, documented, implemented, and reviewed |
Privacy-specific audit logging for all data access and modifications. Log retention per regulatory requirements. |
| CT.DM-P10 |
Mechanisms for data subjects to authorize processing exist |
Consent collection and management infrastructure. Granular consent options. Consent withdrawal capability. |
CT.DP — Data Processing Policies and Procedures
Governance controls for data processing activities.
| Subcategory |
Description |
Implementation Guidance |
| CT.DP-P1 |
Policies, processes, and procedures for authorizing data processing are maintained and enforced |
Document lawful basis for each processing activity. Implement access controls aligned with authorized purposes. |
| CT.DP-P2 |
Data processing environment is identified, managed, and monitored |
Maintain environment inventory (production, staging, development). Monitor for unauthorized processing. Separate test data from production data. |
| CT.DP-P3 |
Data processing procedures are maintained and monitored to meet established terms |
Standard operating procedures for each processing type. Automated compliance checking. Exception management workflow. |
| CT.DP-P4 |
System or device configurations are set to authorized specifications |
Secure configuration baselines for systems processing personal data. Configuration drift detection. Change management for privacy-relevant settings. |
| CT.DP-P5 |
Data processing activities are monitored and logged |
Real-time monitoring of data processing operations. Anomaly detection for unusual processing patterns. Alerting for policy violations. |
CT.PO — Disassociated Processing
Techniques to process data while minimizing identifiability.
| Subcategory |
Description |
Implementation Guidance |
| CT.PO-P1 |
De-identification is applied to data elements to limit observability or linkability |
Apply pseudonymization, anonymization, or generalization based on use case. Document de-identification methodology. |
| CT.PO-P2 |
Technical measures for disassociated processing are implemented |
Deploy differential privacy, secure multi-party computation, or homomorphic encryption as appropriate. Select technique based on data utility requirements. |
Data Management Architecture
Lifecycle Control Points
Collection --> Storage --> Processing --> Sharing --> Retention --> Deletion
| | | | | |
v v v v v v
Consent Encryption Purpose Access Schedule Cascading
Capture at Rest Limitation Controls Enforcement Purge
| | | | | |
v v v v v v
Audit Log Access Log Process Log Transfer Log Retention Log Deletion Log
Data Element Access Control Matrix
| Operation |
Data Subject |
Data Steward |
Processor |
Analyst |
Admin |
| View own data |
Yes |
Yes |
No |
No |
Yes |
| Export own data |
Yes |
Yes |
No |
No |
Yes |
| Correct own data |
Request |
Yes |
No |
No |
Yes |
| Delete own data |
Request |
Yes |
No |
No |
Yes |
| View aggregate |
No |
Yes |
Yes |
Yes |
Yes |
| Process data |
No |
No |
Yes |
No |
Yes |
| Analyze data |
No |
No |
No |
Yes |
Yes |
| Configure system |
No |
No |
No |
No |
Yes |
Disassociated Processing Techniques
Technique Selection Guide
| Technique |
Identifiability Reduction |
Data Utility |
Computational Cost |
Reversible |
| Pseudonymization |
Medium |
High |
Low |
Yes (with key) |
| k-Anonymity |
Medium-High |
Medium |
Medium |
No |
| l-Diversity |
High |
Medium |
Medium |
No |
| t-Closeness |
High |
Medium-Low |
High |
No |
| Differential Privacy |
Very High |
Medium |
Medium |
No |
| Data Masking |
Low-Medium |
Medium |
Low |
Depends |
| Generalization |
Medium |
Medium |
Low |
No |
| Suppression |
High |
Low |
Low |
No |
| Synthetic Data |
Very High |
Variable |
High |
No |
De-identification Decision Framework
Is the data being shared externally?
├── Yes → Is re-identification risk acceptable?
│ ├── No → Apply formal anonymization (differential privacy, k-anonymity with k>=5)
│ └── Yes → Apply pseudonymization with contractual controls
└── No → Is the data used for analytics?
├── Yes → Apply aggregation or differential privacy
└── No → Apply pseudonymization with access controls
Retention Schedule Template
| Data Category |
Retention Period |
Legal Basis |
Deletion Method |
Verification |
| Customer transaction records |
7 years from transaction |
Tax/accounting regulations |
Secure overwrite |
Automated audit |
| Marketing consent records |
Duration of consent + 3 years |
Legitimate interest (proof) |
Logical deletion |
Annual review |
| Employee personnel files |
Employment + 7 years |
Employment law |
Secure destruction |
HR verification |
| Website analytics |
26 months |
Consent |
Automated purge |
Monthly check |
| Support tickets |
3 years from resolution |
Contract performance |
Secure overwrite |
Quarterly audit |
| CCTV footage |
30 days |
Legitimate interest |
Automated overwrite |
Weekly check |
| Backup tapes |
90 days rolling |
Business continuity |
Tape degaussing |
Quarterly audit |
Audit Logging Requirements
Privacy-Specific Events to Log
| Event Category |
Specific Events |
Required Fields |
| Data Access |
View, export, download |
User ID, timestamp, data subject ID, data elements accessed, purpose |
| Data Modification |
Create, update, correct |
User ID, timestamp, data subject ID, before/after values, purpose |
| Data Deletion |
Delete, purge, anonymize |
User ID, timestamp, data subject ID, deletion scope, verification |
| Consent Changes |
Grant, withdraw, modify |
Data subject ID, timestamp, consent scope, collection channel |
| Data Transfer |
Internal transfer, external disclosure |
User ID, timestamp, recipient, data elements, legal basis |
| Configuration |
Access control changes, retention policy changes |
Admin ID, timestamp, before/after settings, approval reference |
Control Mapping
| NIST PF CONTROL |
ISO 27701 |
GDPR Article |
NIST 800-53 |
| CT.DM-P1 |
A.7.3.3 |
Art. 15 |
PM-25 |
| CT.DM-P2 |
A.7.3.7 |
Art. 20 |
PM-25 |
| CT.DM-P3 |
A.7.3.4 |
Art. 16 |
PM-25 |
| CT.DM-P4 |
A.7.3.5 |
Art. 17 |
PM-25 |
| CT.DM-P6 |
A.7.4.7 |
Art. 5(1)(e) |
SI-12 |
| CT.DM-P9 |
A.7.2.8 |
Art. 30 |
AU-2 |
| CT.DM-P10 |
A.7.2.3 |
Art. 6, 7 |
IP-1 |
| CT.DP-P1 |
A.7.2.2 |
Art. 6(1) |
PT-3 |
| CT.DP-P5 |
A.7.2.8 |
Art. 30 |
AU-6 |
| CT.PO-P1 |
A.7.4.5 |
Art. 25(1) |
PM-24 |
| CT.PO-P2 |
A.7.4.5 |
Art. 25(1) |
PM-24 |
References
- NIST Privacy Framework Version 1.0 (January 16, 2020)
- NIST SP 800-188 — De-Identifying Government Datasets
- NIST IR 8053 — De-Identification of Personal Information
- ISO/IEC 20889:2018 — Privacy Enhancing Data De-identification Techniques
1---2name: nist-pf-control3description: Implement the NIST Privacy Framework CONTROL function covering CT.DM data management, CT.DP data processing policies and procedures, and CT.PO disassociated processing. Provides technical control architectures, data management workflows, and de-identification implementation guidance.4license: Apache-2.05---67# NIST Privacy Framework — CONTROL Function89## Overview1011The CONTROL function develops and implements appropriate activities to enable organizations and individuals to manage data with sufficient granularity to manage privacy risks. It addresses data management, data processing governance, and disassociated processing techniques.1213## CONTROL Function Subcategories1415### CT.DM — Data Management1617Policies and procedures for managing data throughout its lifecycle.1819| Subcategory | Description | Implementation Guidance |20|-------------|-------------|------------------------|21| CT.DM-P1 | Data elements can be accessed for review | Implement data subject access portals. Provide export in machine-readable formats (JSON, CSV). Response within regulatory timelines. |22| CT.DM-P2 | Data elements can be accessed for transmission or disclosure | Support data portability requests. Implement secure transfer mechanisms. Maintain disclosure logs. |23| CT.DM-P3 | Data elements can be accessed for alteration | Enable data correction workflows. Propagate corrections across all systems holding the data. |24| CT.DM-P4 | Data elements can be accessed for deletion | Implement cascading deletion across primary and backup systems. Maintain deletion verification logs. Address data in analytics pipelines. |25| CT.DM-P5 | Data processing activities are configured to meet the organization's data processing principles | Default to most privacy-protective settings. Implement purpose limitation at the system level. |26| CT.DM-P6 | Retention schedules are established and in place | Define retention periods per data category. Implement automated purging. Document legal hold exceptions. |27| CT.DM-P7 | Data are processed in accordance with established retention schedules | Automated enforcement of retention policies. Regular audits of data stores. Reporting on retention compliance. |28| CT.DM-P8 | Integrity of data elements is maintained | Implement checksums and validation rules. Detect and resolve data quality issues. Track data lineage. |29| CT.DM-P9 | Audit/log records are determined, documented, implemented, and reviewed | Privacy-specific audit logging for all data access and modifications. Log retention per regulatory requirements. |30| CT.DM-P10 | Mechanisms for data subjects to authorize processing exist | Consent collection and management infrastructure. Granular consent options. Consent withdrawal capability. |3132### CT.DP — Data Processing Policies and Procedures3334Governance controls for data processing activities.3536| Subcategory | Description | Implementation Guidance |37|-------------|-------------|------------------------|38| CT.DP-P1 | Policies, processes, and procedures for authorizing data processing are maintained and enforced | Document lawful basis for each processing activity. Implement access controls aligned with authorized purposes. |39| CT.DP-P2 | Data processing environment is identified, managed, and monitored | Maintain environment inventory (production, staging, development). Monitor for unauthorized processing. Separate test data from production data. |40| CT.DP-P3 | Data processing procedures are maintained and monitored to meet established terms | Standard operating procedures for each processing type. Automated compliance checking. Exception management workflow. |41| CT.DP-P4 | System or device configurations are set to authorized specifications | Secure configuration baselines for systems processing personal data. Configuration drift detection. Change management for privacy-relevant settings. |42| CT.DP-P5 | Data processing activities are monitored and logged | Real-time monitoring of data processing operations. Anomaly detection for unusual processing patterns. Alerting for policy violations. |4344### CT.PO — Disassociated Processing4546Techniques to process data while minimizing identifiability.4748| Subcategory | Description | Implementation Guidance |49|-------------|-------------|------------------------|50| CT.PO-P1 | De-identification is applied to data elements to limit observability or linkability | Apply pseudonymization, anonymization, or generalization based on use case. Document de-identification methodology. |51| CT.PO-P2 | Technical measures for disassociated processing are implemented | Deploy differential privacy, secure multi-party computation, or homomorphic encryption as appropriate. Select technique based on data utility requirements. |5253## Data Management Architecture5455### Lifecycle Control Points5657```58Collection --> Storage --> Processing --> Sharing --> Retention --> Deletion59 | | | | | |60 v v v v v v61 Consent Encryption Purpose Access Schedule Cascading62 Capture at Rest Limitation Controls Enforcement Purge63 | | | | | |64 v v v v v v65 Audit Log Access Log Process Log Transfer Log Retention Log Deletion Log66```6768### Data Element Access Control Matrix6970| Operation | Data Subject | Data Steward | Processor | Analyst | Admin |71|-----------|-------------|-------------|-----------|---------|-------|72| View own data | Yes | Yes | No | No | Yes |73| Export own data | Yes | Yes | No | No | Yes |74| Correct own data | Request | Yes | No | No | Yes |75| Delete own data | Request | Yes | No | No | Yes |76| View aggregate | No | Yes | Yes | Yes | Yes |77| Process data | No | No | Yes | No | Yes |78| Analyze data | No | No | No | Yes | Yes |79| Configure system | No | No | No | No | Yes |8081## Disassociated Processing Techniques8283### Technique Selection Guide8485| Technique | Identifiability Reduction | Data Utility | Computational Cost | Reversible |86|-----------|--------------------------|-------------|-------------------|------------|87| Pseudonymization | Medium | High | Low | Yes (with key) |88| k-Anonymity | Medium-High | Medium | Medium | No |89| l-Diversity | High | Medium | Medium | No |90| t-Closeness | High | Medium-Low | High | No |91| Differential Privacy | Very High | Medium | Medium | No |92| Data Masking | Low-Medium | Medium | Low | Depends |93| Generalization | Medium | Medium | Low | No |94| Suppression | High | Low | Low | No |95| Synthetic Data | Very High | Variable | High | No |9697### De-identification Decision Framework9899```100Is the data being shared externally?101├── Yes → Is re-identification risk acceptable?102│ ├── No → Apply formal anonymization (differential privacy, k-anonymity with k>=5)103│ └── Yes → Apply pseudonymization with contractual controls104└── No → Is the data used for analytics?105 ├── Yes → Apply aggregation or differential privacy106 └── No → Apply pseudonymization with access controls107```108109## Retention Schedule Template110111| Data Category | Retention Period | Legal Basis | Deletion Method | Verification |112|--------------|-----------------|-------------|-----------------|-------------|113| Customer transaction records | 7 years from transaction | Tax/accounting regulations | Secure overwrite | Automated audit |114| Marketing consent records | Duration of consent + 3 years | Legitimate interest (proof) | Logical deletion | Annual review |115| Employee personnel files | Employment + 7 years | Employment law | Secure destruction | HR verification |116| Website analytics | 26 months | Consent | Automated purge | Monthly check |117| Support tickets | 3 years from resolution | Contract performance | Secure overwrite | Quarterly audit |118| CCTV footage | 30 days | Legitimate interest | Automated overwrite | Weekly check |119| Backup tapes | 90 days rolling | Business continuity | Tape degaussing | Quarterly audit |120121## Audit Logging Requirements122123### Privacy-Specific Events to Log124125| Event Category | Specific Events | Required Fields |126|---------------|-----------------|-----------------|127| Data Access | View, export, download | User ID, timestamp, data subject ID, data elements accessed, purpose |128| Data Modification | Create, update, correct | User ID, timestamp, data subject ID, before/after values, purpose |129| Data Deletion | Delete, purge, anonymize | User ID, timestamp, data subject ID, deletion scope, verification |130| Consent Changes | Grant, withdraw, modify | Data subject ID, timestamp, consent scope, collection channel |131| Data Transfer | Internal transfer, external disclosure | User ID, timestamp, recipient, data elements, legal basis |132| Configuration | Access control changes, retention policy changes | Admin ID, timestamp, before/after settings, approval reference |133134## Control Mapping135136| NIST PF CONTROL | ISO 27701 | GDPR Article | NIST 800-53 |137|-----------------|-----------|--------------|-------------|138| CT.DM-P1 | A.7.3.3 | Art. 15 | PM-25 |139| CT.DM-P2 | A.7.3.7 | Art. 20 | PM-25 |140| CT.DM-P3 | A.7.3.4 | Art. 16 | PM-25 |141| CT.DM-P4 | A.7.3.5 | Art. 17 | PM-25 |142| CT.DM-P6 | A.7.4.7 | Art. 5(1)(e) | SI-12 |143| CT.DM-P9 | A.7.2.8 | Art. 30 | AU-2 |144| CT.DM-P10 | A.7.2.3 | Art. 6, 7 | IP-1 |145| CT.DP-P1 | A.7.2.2 | Art. 6(1) | PT-3 |146| CT.DP-P5 | A.7.2.8 | Art. 30 | AU-6 |147| CT.PO-P1 | A.7.4.5 | Art. 25(1) | PM-24 |148| CT.PO-P2 | A.7.4.5 | Art. 25(1) | PM-24 |149150## References151152- NIST Privacy Framework Version 1.0 (January 16, 2020)153- NIST SP 800-188 — De-Identifying Government Datasets154- NIST IR 8053 — De-Identification of Personal Information155- ISO/IEC 20889:2018 — Privacy Enhancing Data De-identification Techniques
mukul975