What it covers. NIST guidance on identifying PII and determining the level of protection it needs. It introduces confidentiality impact levels for PII and recommends safeguards and incident response considerations specific to personal data.
In practice. Organisations identify the PII they hold, assess the harm that would result from its disclosure, and apply safeguards such as minimisation, de-identification, access control and encryption accordingly. Incident response plans include steps for breaches of PII. Evidence includes data inventories, impact categorisation and documented safeguards. European organisations typically use it alongside GDPR requirements.
Common gaps. Common gaps are collecting more PII than needed, inventories that miss unstructured data and no specific handling of personal data breaches. Breach response plans also often lack criteria for assessing harm to the people affected.