# NIST Privacy Framework IDENTIFY Function — Assessment Template

## Organization Information

| Field | Value |
|-------|-------|
| Organization Name | |
| Assessment Date | |
| Assessed By | |
| Assessment Scope | |
| Framework Version | NIST PF v1.0 |

## ID.BE — Business Environment

### ID.BE-P1: Organizational Role in Data Processing Ecosystem

| Data Flow | Role (Controller/Processor/Joint) | Documented? | Evidence |
|-----------|----------------------------------|-------------|----------|
| | | Yes / No | |
| | | Yes / No | |

### ID.BE-P2: Organizational Priorities

| Priority Area | Privacy Alignment | Status |
|--------------|-------------------|--------|
| | | |
| | | |

### ID.BE-P3: Systems/Products/Services Inventory

| System Name | Data Types | Risk Tier | Owner | Last Reviewed |
|------------|-----------|----------|-------|-------------|
| | | High / Medium / Low | | |
| | | High / Medium / Low | | |

## ID.DA — Data Actions

### ID.DA-P1: Data Processing Ecosystem Inventory

| Processing Activity | Purpose | Legal Basis | Data Categories | Data Subjects | Retention |
|---------------------|---------|-------------|-----------------|---------------|-----------|
| | | | | | |

### ID.DA-P2: Data Action Owners

| Data Action | Owner | Department | Accountability Level |
|------------|-------|-----------|---------------------|
| | | | |

### ID.DA-P3: Problematic Data Action Screening

| Data Action | Problematic Data Action | Likelihood (1-5) | Impact (1-5) | Risk Score |
|------------|------------------------|-------------------|---------------|------------|
| | | | | |

## ID.RA — Risk Assessment

### ID.RA-P1: Identified Risks

| Risk ID | Description | Related PDA | Likelihood | Impact | Risk Level |
|---------|-------------|------------|------------|--------|------------|
| | | | | | |

### ID.RA-P3: Risk Responses

| Risk ID | Response Strategy | Controls | Owner | Deadline | Residual Risk |
|---------|------------------|----------|-------|----------|---------------|
| | Mitigate / Transfer / Avoid / Accept | | | | |

## ID.IM — Improvement

### ID.IM-P1: Improvement Process

| Aspect | Current State | Target State | Action Needed |
|--------|-------------|-------------|---------------|
| Risk methodology | | | |
| Tool capability | | | |
| Team expertise | | | |

### ID.IM-P2: Improvement Plan

| Finding | Improvement Action | Owner | Deadline | Status |
|---------|-------------------|-------|----------|--------|
| | | | | |

## Assessment Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Assessor | | | |
| DPO/CPO | | | |
| Business Owner | | | |