# NIST PF GOVERN Function — Standards References

## Primary Standards

### NIST Privacy Framework Version 1.0
- **Published**: January 16, 2020
- **Relevance**: Defines the GOVERN function and all subcategories (GV.AT, GV.MT, GV.PO, GV.RR)

### NIST SP 800-53 Rev. 5
- **Published**: September 2020
- **Relevance**: PM (Program Management) control family maps directly to GOVERN function
- **Key controls**: PM-1 (Policy/Procedures), PM-2 (Senior Agency Official), PM-3 (Resources), PM-13 (Workforce), PM-14 (Testing/Training)

### ISO/IEC 27701:2019
- **Relevance**: Clause 5 (PIMS-specific requirements) aligns with governance structure requirements
- **Key sections**: 5.1 (Leadership), 5.2 (Policy), 5.3 (Roles/Responsibilities), 7.1 (Resources)

## Supplementary Standards

### IAPP CIPM Body of Knowledge
- **Relevance**: Privacy program management competencies for GV.RR and GV.AT implementation

### ISO/IEC 27001:2022
- **Relevance**: Information security management system requirements that inform privacy governance

### COBIT 2019 — Governance of Enterprise IT
- **Relevance**: IT governance framework applicable to privacy program governance structures

## Regulatory Requirements

### GDPR
- Article 37-39: Data Protection Officer requirements (GV.RR)
- Article 38(2): Resources for DPO (GV.RR-P2)
- Article 39(1)(b): Training obligations (GV.AT)
- Article 24(1): Controller accountability (GV.PO-P4)

### UK Data Protection Act 2018
- Section 69-71: DPO requirements under UK law