# NIST PF IDENTIFY Function — Standards References

## Primary Standards

### NIST Privacy Framework Version 1.0
- **Published**: January 16, 2020
- **Publisher**: National Institute of Standards and Technology (NIST)
- **URL**: https://www.nist.gov/privacy-framework
- **Relevance**: Defines the IDENTIFY function and all subcategories (ID.BE, ID.DA, ID.IM, ID.RA)

### NIST SP 800-37 Rev. 2 — Risk Management Framework
- **Published**: December 2018
- **Relevance**: Provides the overarching risk management framework that the IDENTIFY function operates within
- **Key sections**: Chapter 2 (Fundamentals), Chapter 3 (Risk Management Process)

### NIST IR 8062 — Privacy Engineering and Risk Management
- **Published**: January 2017
- **Relevance**: Introduces problematic data actions concept used in ID.DA and ID.RA subcategories
- **Key concept**: Catalog of problematic data actions (appropriation, distortion, induced disclosure, insecurity, re-identification, stigmatization, surveillance, unanticipated revelation)

### ISO/IEC 27701:2019
- **Published**: August 2019
- **Publisher**: ISO/IEC
- **Relevance**: Maps to IDENTIFY function through clauses on privacy risk assessment and data inventory

## Supplementary Standards

### ISO/IEC 29100:2011 — Privacy Framework
- **Relevance**: Defines privacy principles that inform the IDENTIFY function's scope

### NIST SP 800-53 Rev. 5 — Security and Privacy Controls
- **Published**: September 2020
- **Relevance**: PT (PII Processing and Transparency) and PM (Program Management) control families map to IDENTIFY subcategories

### NIST Cybersecurity Framework Version 1.1
- **Published**: April 2018
- **Relevance**: The IDENTIFY function in the Privacy Framework mirrors and extends the CSF IDENTIFY function with privacy-specific subcategories

## Regulatory Alignment

### GDPR (Regulation EU 2016/679)
- Articles 24, 25, 30, 35: Controller obligations, privacy by design, records of processing, DPIAs
- Recitals 75-77: Risk assessment requirements

### CCPA/CPRA (California Civil Code 1798.100-199)
- Sections 1798.110, 1798.130: Disclosure and transparency requirements
- Section 1798.185: Rulemaking authority for risk assessments