NIST Privacy Framework Profiles: Current vs. Target Profiles
A privacy gap assessment is only useful if it shows what an organization is achieving, what it needs to achieve, and which improvements to prioritize. The NIST Privacy Framework uses Current and Target Profiles to help organizations make that comparison.
A Current Profile documents the privacy outcomes an organization currently achieves. A Target Profile describes the outcomes it wants to achieve based on its privacy risks, business objectives, stakeholder needs, and applicable requirements. Comparing the two helps teams identify gaps and turn them into an improvement plan.
This guide explains how to develop each Profile and use the results to prioritize privacy improvements.
Current vs. Target Profile at a glance
| Current Profile | Target Profile | |
| Purpose | Describe privacy outcomes currently achieved | Describe desired privacy outcomes |
| Based on | Existing practices and supporting evidence | Privacy risks, requirements, business objectives, and stakeholder needs |
| Main question | What are we achieving now? | What outcomes do we need to achieve? |
| Main activity | Assess existing outcomes | Select and prioritize desired outcomes |
| Result | A documented baseline | A defined desired state |
| How it is used | Reveals current gaps and limitations | Guides improvement priorities and actions |
Both Profiles select relevant Functions, Categories, and Subcategories from the NIST Privacy Framework Core. An organization can tailor its selections to its needs; it does not have to include every outcome in the Core.
How to build a Current Profile
A Current Profile should reflect what the organization actually does and achieves, not simply what its policies say it does. The assessment needs to consider both documented procedures and how they operate in practice.
1. Select the outcomes to assess
Define the scope first. You might assess a particular product, service, business unit, or data processing activity rather than the entire organization.
Select the relevant Core outcomes based on that scope, the organization’s role in processing data, its privacy risks, and applicable requirements. This keeps the assessment focused on outcomes that matter to the area being reviewed.
2. Gather evidence of existing practices
Review the records and activities that demonstrate how privacy risks are managed. Depending on the outcome, useful evidence might include:
- Privacy policies and procedures.
- Data inventories and records of processing activities.
- Privacy risk assessments.
- System configurations and access records.
- Vendor assessments and contractual requirements.
- Training records, incident reports, and monitoring results.
Evidence should match the outcome being assessed. A written procedure may show that a process is defined, but it does not necessarily show that staff follow it consistently.
3. Interview the people responsible
Speak with the teams that perform or oversee the relevant activities. These may include privacy, legal, security, IT, procurement, product development, and business operations.
Ask how the process works, who owns it, what happens when an issue arises, and how the team verifies the intended outcome. Compare these answers with available records and observed practices.
4. Record the current state
For each selected outcome, document the assessment result, supporting evidence, owner, and any identified limitations.
NIST does not prescribe a universal numerical scoring scale for Profiles. If a rating scale helps your team apply assessments consistently, you could use the following internal scale:
| Suggested rating | What it may mean |
| Not achieved | There is no sufficient evidence that the outcome is being achieved. |
| Partially achieved | Some relevant practices exist, but important gaps remain. |
| Largely achieved | The outcome is mostly achieved, with limited gaps or inconsistencies. |
| Fully achieved | Available evidence supports that the outcome is being achieved within the defined scope. |
These ratings are a suggested assessment method, not official NIST Profile ratings. Define the criteria before starting and apply them consistently. Where evidence is incomplete, record that limitation instead of assuming the outcome is achieved.
Quick link: NIST AI RMF Generative AI Profile: A complete guide
How to build a Target Profile
A Target Profile defines the privacy outcomes the organization wants to achieve. Its purpose is to guide decisions about what needs to change, not to list every possible activity in the framework.
1. Identify the factors that should shape the target
Use the organization’s privacy risk assessments and business context to determine which outcomes deserve attention. Consider:
- Privacy risks: Potential impacts on individuals arising from data processing.
- Legal and contractual requirements: Applicable privacy laws, regulations, customer commitments, and vendor obligations.
- Business objectives: The outcomes required to support products, services, and operations.
- Stakeholder expectations: The privacy needs of customers, employees, partners, and other affected individuals.
- Available resources and capabilities: The people, processes, and technology needed to achieve the desired outcomes.
These factors help distinguish high-priority outcomes from those that are less relevant to the organization’s current scope and risk priorities.
2. Select relevant Core outcomes
Choose the Functions, Categories, and Subcategories that support the desired privacy outcomes. The selection should reflect the organization’s context and risk priorities.
A company handling sensitive customer information may prioritize outcomes related to data processing awareness, access to personal data, data minimization, and third-party privacy requirements.
The target does not need to include every Core outcome. If an outcome is excluded because it is outside the scope or not currently a priority, document the rationale where doing so helps explain the risk decision and future priorities.
3. Define what success should look like
For each selected outcome, describe the state the organization wants to achieve. Make the target specific enough to guide implementation and later assessment.
For example, rather than writing “improve vendor privacy,” specify that relevant third-party services must undergo a privacy assessment before approval, with requirements and follow-up reviews based on risk.
The Target Profile can also inform privacy requirements during system development. NIST’s 1.1 draft describes using it across system development life cycle phases, including planning, design, build or buy, deployment, operation, and decommissioning.
4. Set priorities and ownership
Not every desired outcome needs the same deadline or level of investment. Record which outcomes take priority, who is responsible, and what resources or decisions are needed.
A Target Profile can also describe outcomes that the organization cannot achieve immediately. The important point is to make the desired state and remaining gaps clear enough to support informed decisions.
Current and Target Profiles vs. Implementation Tiers
Profiles and Implementation Tiers serve different purposes in the NIST Privacy Framework.
Profiles describe privacy outcomes. The Current Profile represents outcomes the organization is achieving, while the Target Profile represents desired outcomes. Comparing them helps identify gaps and prioritize improvement actions.
Implementation Tiers characterize aspects of an organization’s privacy risk management practices. In version 1.0, the four Tiers are:
The Tiers describe the degree to which privacy risk management is integrated into organizational decision-making, informed by risk, repeatable, and responsive to change. They are not scores for individual Core Subcategories.
An organization can use its Target Profile when considering which Tier is appropriate. Still, it should not treat the Tiers as a mandatory progression or assume that reaching Tier 4 is always the goal. The right approach depends on the organization’s risks, objectives, resources, and risk management practices.
Quick link: NIST AI RMF vs. ISO 42001 vs. EU AI Act: How they fit together
When to use multiple NIST Privacy Framework Profiles
One organization-wide Profile may be enough when privacy risks and practices are relatively consistent. Separate Profiles can be more useful when different systems, products, services, or business units have distinct data processing activities, obligations, or risk priorities.
For example, a company may need different Target Profiles for its customer-facing application and its employee information systems. Their data uses, stakeholders, and privacy requirements may differ enough that a single Profile would hide important gaps.
NIST also describes Community Profiles, which can capture shared privacy interests and goals for a sector, technology, or other use case. Organizations can use a relevant Community Profile as a reference when developing their own Organizational Profiles.
Before adopting an existing Profile, check that it is relevant to the organization’s activities and requirements. It should inform the organization’s outcome selection, not replace its own assessment.
Keeping Profiles up to date
Profiles should change when the organization’s activities or privacy risk priorities change. Review them when a new product or data use is introduced, a significant vendor relationship changes, privacy requirements shift, or an incident reveals a gap in existing practices.
The review interval should reflect the organization’s risk and operating context; NIST does not set one universal schedule for every organization. Reassess the Current Profile periodically and capture the results in an updated version. Revise the Target Profile when priorities, requirements, or desired outcomes change.
For the broader process of putting identified improvements into practice, see our NIST Privacy Framework implementation guide.
How CyberArrow can support privacy risk and control tracking
Maintaining Profiles requires teams to track privacy risks, supporting evidence, control activities, and improvement actions. A GRC platform can help organize this information and make outstanding issues easier to follow.
CyberArrow GRC supports risk and compliance workflows, including centralized risk records, evidence collection, control monitoring, and remediation tracking. These capabilities can support privacy assessments and improvement plans; teams remain responsible for selecting the relevant NIST outcomes and evaluating whether they are achieved.
Schedule a demo to see how CyberArrow can support your risk, control, and compliance workflows.
FAQs
Does NIST require a specific Profile template or scoring scale?
No. NIST does not prescribe a universal Profile template or numerical scoring scale. Organizations can tailor the Profile format and use an internal rating method, as long as they define and apply it consistently.
Should a Target Profile include every NIST Privacy Framework Subcategory?
No. Organizations can select and tailor Core outcomes based on their context and privacy risk priorities. The selection should reflect the outcomes needed for the defined scope rather than treating the Core as a mandatory checklist.
How often should an organization update its NIST Privacy Framework Profiles?
There is no single required interval for every organization. Reassess the Current Profile periodically and revisit the Target Profile when privacy risks, business activities, stakeholder needs, or requirements change.
