Skip to content
cccskills
FreePublished on GitHub

nist-pf-govern

Implement the NIST Privacy Framework GOVERN function covering GV.AT awareness and training, GV.MT monitoring and review, GV.PO policy development, and GV.RR roles and responsibilities. Provides governance structure templates, training programs, and accountability frameworks for privacy governance.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

Run score Not tested

See how to install

Files included (5)

  • SKILL.md8.5 KB
  • assets/template.md1.8 KB
  • references/standards.md1.5 KB
  • references/workflows.md2.3 KB
  • scripts/process.py7.7 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

NIST Privacy Framework — GOVERN Function

Overview

The GOVERN function establishes and monitors the organization's privacy governance structure, including policies, processes, and procedures for managing privacy risk. It is the foundational function that enables all other NIST Privacy Framework functions.

GOVERN Function Subcategories

GV.AT — Awareness and Training

Building organizational awareness and capability for privacy risk management.

SubcategoryDescriptionImplementation Guidance
GV.AT-P1The workforce is informed and trained on its roles and responsibilitiesDevelop role-based privacy training curricula. New hire training within 30 days, annual refresher for all staff.
GV.AT-P2Senior executives understand their roles and responsibilitiesExecutive briefings quarterly. Board-level privacy risk reporting semi-annually.
GV.AT-P3Privacy personnel understand their roles and responsibilitiesSpecialized training for DPOs, privacy engineers, and legal counsel. Professional certification support (CIPP, CIPM, CIPT).
GV.AT-P4Third parties (service providers, customers, partners) understand their roles and responsibilitiesInclude privacy requirements in contracts. Provide vendor privacy guidelines. Verify third-party training compliance.

GV.MT — Monitoring and Review

Ongoing assessment of privacy governance effectiveness.

SubcategoryDescriptionImplementation Guidance
GV.MT-P1Privacy risk is re-assessed on an ongoing basis and as key factors changeTrigger-based reassessment: new processing activities, regulatory changes, incidents, organizational changes.
GV.MT-P2Privacy risk management activities are periodically reviewedConduct quarterly operational reviews and annual strategic reviews. Benchmark against industry peers.
GV.MT-P3Privacy policies, processes, and procedures are maintained and used to manage privacy riskVersion control for all privacy documentation. Annual policy review cycle with defined approval workflow.
GV.MT-P4Privacy risk assessment results are shared with stakeholdersDistribute risk dashboards to executive leadership monthly. Share relevant findings with operational teams weekly.

GV.PO — Policy

Privacy policies governing organizational approach to privacy risk management.

SubcategoryDescriptionImplementation Guidance
GV.PO-P1Organizational privacy values and policies are established and communicatedPublish a privacy mission statement. Develop comprehensive privacy policy suite aligned with organizational values.
GV.PO-P2Processes to instill organizational privacy values within data processing activities are establishedEmbed privacy requirements into SDLC. Require privacy review at design stage for all new data processing.
GV.PO-P3Roles and responsibilities for privacy workforce are establishedDefine RACI matrices for privacy functions. Document authority levels and escalation paths.
GV.PO-P4Privacy is integrated into organizational risk managementInclude privacy in enterprise risk register. Align privacy risk appetite with organizational risk tolerance.
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managedMaintain regulatory tracking register. Map obligations to controls. Conduct annual compliance assessments.
GV.PO-P6Governance and risk management policies address privacy risksPrivacy risk addressed in board risk committee charter. Executive-level accountability for privacy.

GV.RR — Roles and Responsibilities

Establishing accountability structures for privacy risk management.

SubcategoryDescriptionImplementation Guidance
GV.RR-P1Organizational leadership is responsible and accountable for privacy riskC-suite privacy accountability documented. Chief Privacy Officer reports to CEO or General Counsel.
GV.RR-P2Adequate resources for privacy programs are allocatedAnnual privacy budget planning. Headcount planning for privacy team. Technology investment for privacy tools.
GV.RR-P3Processes are in place to determine, assess, and manage privacy risksFormal privacy risk management methodology adopted. Standard operating procedures for risk assessment.

Governance Structure Template

Organizational Hierarchy

Board of Directors / Audit Committee
    |
Chief Executive Officer
    |
Chief Privacy Officer (CPO) / Data Protection Officer (DPO)
    |
    +-- Privacy Legal Counsel
    +-- Privacy Engineering Lead
    +-- Privacy Operations Manager
    +-- Privacy Compliance Analyst
    |
Business Unit Privacy Champions (distributed model)

RACI Matrix for Key Privacy Activities

ActivityCPO/DPOLegalEngineeringBusiness UnitsExecutive
Privacy strategyACCIR
Policy developmentRRCCA
DPIA executionACRRI
Incident responseRRCCI
Training deliveryACIRI
Regulatory monitoringCRIIA
Vendor assessmentARCRI
Metrics reportingRICCA

R = Responsible, A = Accountable, C = Consulted, I = Informed

Training Program Framework

Tier 1 — General Awareness (All Staff)

  • Frequency: Annual, plus new hire onboarding
  • Duration: 45 minutes
  • Topics: Privacy principles, data handling basics, incident reporting, individual rights
  • Assessment: Quiz with 80% pass threshold

Tier 2 — Role-Specific (Data Handlers)

  • Frequency: Semi-annual
  • Duration: 2 hours
  • Topics: Data classification, access controls, secure processing, retention schedules
  • Assessment: Scenario-based exercises

Tier 3 — Specialist (Privacy Team)

  • Frequency: Quarterly
  • Duration: 4 hours
  • Topics: Regulatory updates, advanced risk assessment, PET implementation, incident management
  • Assessment: Practical exercises and case studies

Tier 4 — Executive (Leadership)

  • Frequency: Semi-annual
  • Duration: 1 hour
  • Topics: Privacy risk landscape, regulatory exposure, strategic alignment, board reporting
  • Assessment: N/A (discussion-based)

Policy Suite Inventory

PolicyOwnerReview CycleApproval Authority
Enterprise Privacy PolicyCPOAnnualCEO
Data Classification PolicyCISO/CPOAnnualCTO
Data Retention PolicyCPOAnnualGeneral Counsel
Data Subject Rights PolicyCPOAnnualGeneral Counsel
Privacy Incident Response PolicyCPOSemi-AnnualCISO
Third-Party Data Processing PolicyCPOAnnualProcurement Lead
Cross-Border Transfer PolicyLegalAnnualGeneral Counsel
Cookie and Tracking PolicyCPOSemi-AnnualCMO
Employee Privacy PolicyCPO/HRAnnualCHRO
Privacy-by-Design StandardsPrivacy EngineeringAnnualCTO

Control Mapping

NIST PF GOVERNISO 27701GDPR ArticleSOC 2 TSC
GV.AT-P17.2.2Art. 39(1)(b)CC1.4
GV.AT-P25.1Art. 38(3)CC1.2
GV.MT-P19.1Art. 24(1)CC4.1
GV.MT-P35.2Art. 24(2)CC1.3
GV.PO-P15.2Art. 5(1)CC1.1
GV.PO-P45.3.2Art. 24(1)CC3.1
GV.PO-P55.2.1Art. 5(1)(a)CC2.2
GV.RR-P15.3Art. 37-39CC1.2
GV.RR-P27.1Art. 38(2)CC1.1

References

  • NIST Privacy Framework Version 1.0 (January 16, 2020)
  • NIST SP 800-53 Rev. 5 — Security and Privacy Controls (PM family)
  • ISO/IEC 27701:2019 — Clause 5 (PIMS-specific requirements)
  • IAPP CIPM Body of Knowledge — Privacy Program Management

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills318Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills318Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills318Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills318Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills318Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills318Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill