SMSMC Blog
Privacy Program LeadershipOctober 2026 · 7 min read

A privacy program a small team can run: the NIST Privacy Framework in 90 days

Privacy teams are shrinking while privacy laws and AI uses multiply. How to use the NIST Privacy Framework, alongside CSF 2.0, to set a realistic target and build a program a small team can sustain.

By Jim Venuto

Privacy obligations keep growing, but privacy teams are not. ISACA’s State of Privacy 2026, based on more than 1,800 privacy professionals, found the median privacy staff size dropped from eight in 2025 to five in 2026. Forty-three percent said their privacy budget is underfunded, half expect it to fall in the next year, and only 46 percent were very or completely confident in their team’s ability to comply with new privacy laws. The IAPP’s US State Privacy Legislation Tracker (last updated September 8, 2026) lists 23 states that have signed comprehensive privacy laws, several of which take effect in 2027 or later.

At the same time, AI is pulling privacy work forward. Cisco’s 2026 Data and Privacy Benchmark, a survey of 5,200 IT, technology and security professionals, reports AI as the primary catalyst driving 90% of companies to expand their privacy programs, and that while three in four organizations have a dedicated AI governance body, only 12% describe these structures as mature.

For a mid-size firm, a school district or a local government, the answer is not a bigger program. It is a smaller one that is clearly scoped, built on a framework that auditors and regulators recognize, and run by people who already have other jobs.

The framework: what the NIST Privacy Framework is, and its status

The NIST Privacy Framework is a voluntary tool for managing privacy risk. Version 1.0 was published on January 16, 2020. Version 1.1 was released as an initial public draft in April 2025, with comments closing June 13, 2025; NIST’s page still lists the final version as “Coming soon.” The draft realigns the framework with CSF 2.0, adds a section on AI and privacy risk, and moves third-party (data processing ecosystem) risk management into Govern-P. Everything below works under either version.

The framework has five functions, which NIST says “should be performed concurrently and continuously”:

  • Identify-P: understand the privacy risks to individuals that arise from your data processing.
  • Govern-P: the governance structure, policies, roles and oversight that set your privacy risk priorities.
  • Control-P: manage data with enough granularity to manage privacy risk (collection, use, retention, disposal).
  • Communicate-P: give individuals and the organization a “reliable understanding” of how data are processed.
  • Protect-P: appropriate data processing safeguards.

If you already run a CSF 2.0 security program, the 1.1 draft says you “may use all six CSF 2.0 Functions in conjunction with Identify-P, Govern-P, Control-P, and Communicate-P.” In practice, security covers protection and incident handling, and the privacy program adds the four privacy-specific functions on top. NIST publishes a crosswalk between the two in its resource repository.

Two concepts make the framework usable for a small team. Profiles: a Current Profile (what you do now) and a Target Profile (what you need), whose differences “enable an organization to identify gaps, develop an action plan for improvement.” Tiers: Partial, Risk Informed, Repeatable and Adaptive. The draft is explicit that “not all organizations need to achieve Tiers 3 or 4.” A small organization that reaches a consistent Tier 2 has a defensible program.

What New York already requires

Businesses holding New Yorkers’ private information. Under General Business Law § 899-aa, as amended in December 2024, notice to affected New York residents must be made within thirty days after a breach is discovered, and the definition of private information now includes medical and health-insurance information. § 899-bb requires reasonable safeguards, including secure disposal. For a small business (fewer than fifty employees, less than three million dollars in gross annual revenue, or less than five million dollars in year-end total assets), safeguards must be “appropriate for the size and complexity of the small business.”

School districts and BOCES. Education Law § 2-d and 8 NYCRR Part 121 require each educational agency to publish a Parents’ Bill of Rights for data privacy and security, with supplemental information for each vendor contract, and to designate a Data Protection Officer (an existing employee may serve). Part 121 was amended in February 2026 to adopt NIST CSF 2.0 as the standard, and district policies had to align with CSF 2.0 by September 1, 2026. The Privacy Framework is not mandated, but its Govern-P, Control-P and Communicate-P outcomes map directly onto the Bill of Rights, vendor contracts and DPO duties.

A first 90 days

NIST’s guide for small and medium businesses uses a “Ready, Set, Go” model. Adapted for a small team:

Days 1–30: Identify-P.

  • Inventory the systems, products and services that process personal data (ID.IM-P1), and sketch the data map: what you collect, where it goes, who receives it. NIST’s guide is clear that this “doesn’t have to be comprehensive, especially at first.”
  • Ask the guide’s blunt question: “Are you collecting, sharing, or keeping data that you don’t need?”
  • Include AI. List the AI tools and features that receive personal data. The 1.1 draft names AI-specific privacy attacks such as “data reconstruction, prompt injection, or membership inference.”

Days 31–60: Govern-P.

  • Name a privacy owner and the people who decide on privacy risk.
  • Write the Current Profile, choose a Target Profile and Tier, and turn the gap into a dated action list.
  • Set retention periods in policy (GV.PO-P1) for the main record types, starting with the largest and most sensitive stores.
  • List the vendors that receive personal data, and check that contracts with them carry privacy terms (GV.DE-P2): permitted use, no secondary use or AI training, breach notice, subprocessors, and return or deletion at the end.

Days 61–90: Control-P and Communicate-P.

  • Delete or archive one data set you no longer need, and record how you did it. A first disposal proves the retention policy is real.
  • Update the privacy notice (and, for schools, the Parents’ Bill of Rights and vendor supplements) so it matches the data map. Cisco’s 2026 study found 46% of respondents see clear communication about how data is collected and used as the most effective way to build customer confidence.
  • Write a one-page breach decision path that meets the 30-day New York notice clock and names who notifies regulators.
  • Report to leadership: the Target Profile, the gap list, and the decisions only leadership can make.

After 90 days, the program runs on a cycle: review the data map when systems change, re-score the profile annually, and assess new vendors and AI uses before they go live.

Where SMC fits

Privacy Medic is Security Medic Consulting’s NIST Privacy Framework practice. Jim Venuto founded SMC after a career leading security, privacy, GRC and CISO-level work for mid-size and large enterprises and public bodies. Privacy Medic builds privacy programs a small team can run: data inventory and mapping, privacy risk assessment, retention and vendor terms, notices, privacy review of AI uses of personal data, and fractional privacy-officer leadership. Where security work is needed, it works with Security Medic’s CSF 2.0 practices so one program serves both.

If you need a privacy program that fits a small team, the Privacy Medic services page describes each engagement. To talk through your starting point, Book a free 30-minute call, or write to support@securitymedic.com.

Sources

Tags#nist-privacy-framework#nist-csf-2#ny-shield#smb#k12#playbook#privacy-officer