NIST Privacy Framework — GOVERN Function

Overview

The GOVERN function establishes and monitors the organization's privacy governance structure, including policies, processes, and procedures for managing privacy risk. It is the foundational function that enables all other NIST Privacy Framework functions.

GOVERN Function Subcategories

GV.AT — Awareness and Training

Building organizational awareness and capability for privacy risk management.

Subcategory	Description	Implementation Guidance
GV.AT-P1	The workforce is informed and trained on its roles and responsibilities	Develop role-based privacy training curricula. New hire training within 30 days, annual refresher for all staff.
GV.AT-P2	Senior executives understand their roles and responsibilities	Executive briefings quarterly. Board-level privacy risk reporting semi-annually.
GV.AT-P3	Privacy personnel understand their roles and responsibilities	Specialized training for DPOs, privacy engineers, and legal counsel. Professional certification support (CIPP, CIPM, CIPT).
GV.AT-P4	Third parties (service providers, customers, partners) understand their roles and responsibilities	Include privacy requirements in contracts. Provide vendor privacy guidelines. Verify third-party training compliance.

nist-pf-govern

NIST Privacy Framework — GOVERN Function

Overview

GOVERN Function Subcategories

GV.AT — Awareness and Training