ISC Privacy · Updated November 2026
Privacy Risk vs Cybersecurity Risk: Why Are There Two NIST Frameworks?
Security and privacy overlap, but securely processing personal information can still create privacy risk.
Cybersecurity risk
Focuses heavily on protecting systems, networks, data, and operations from cybersecurity threats.
Privacy risk
Can arise simply because an organization processes personal information, even when the information is technically secure.
Example
A company can securely collect detailed location data and still create privacy concerns through the collection itself.
Framework overlap
Both frameworks can involve governance, risk identification, controls, and monitoring, but they address different types of risk.
The takeaway
Cybersecurity asks whether data is protected. Privacy also asks whether personal information should be processed that way.
Related Summit guides
FAQ
Can data be secure but still create privacy risk?
Yes.
Are privacy and cybersecurity identical?
No.
Do the frameworks overlap?
Yes.