# NIST PF CONTROL Function — Standards References

## Primary Standards

### NIST Privacy Framework Version 1.0
- **Published**: January 16, 2020
- **Relevance**: Defines CONTROL function subcategories CT.DM, CT.DP, CT.PO

### NIST SP 800-188 — De-Identifying Government Datasets
- **Published**: December 2016
- **Relevance**: De-identification guidance for CT.PO disassociated processing

### NIST IR 8053 — De-Identification of Personal Information
- **Published**: October 2015
- **Relevance**: Technical approaches to de-identification

### ISO/IEC 20889:2018 — Privacy Enhancing Data De-identification Techniques
- **Relevance**: Taxonomy of de-identification techniques for CT.PO implementation

## Supplementary Standards

### ISO/IEC 27701:2019
- **Key sections**: A.7.2 (Conditions for collection and processing), A.7.3 (Data subject obligations), A.7.4 (Privacy by design)

### NIST SP 800-53 Rev. 5
- **Key controls**: AU-2 (Audit Events), PM-25 (Minimization of PII), PT-3 (Purpose specification), SI-12 (Information Management and Retention)

## Regulatory Alignment

### GDPR
- Article 5(1)(b): Purpose limitation (CT.DP-P1)
- Article 5(1)(c): Data minimization (CT.DM-P5)
- Article 5(1)(e): Storage limitation (CT.DM-P6, CT.DM-P7)
- Article 15-20: Data subject access rights (CT.DM-P1 through CT.DM-P4)
- Article 25: Data protection by design and by default (CT.PO)
- Article 30: Records of processing (CT.DM-P9)
- Article 32: Security of processing (CT.DP-P2)