NIST PF CT.PO-P1 - Processing authorization policies (focused outcome view)
Establish policies and processes for authorizing data processing, revoking authorizations and maintaining them, including organizational decisions and individual consent where appropriate.
Where this comes from
Provision: CT.PO-P1 - Processing authorization policies (focused outcome view)
Instrument: NIST Privacy Framework Version 1.0
Citation: NIST Privacy Framework Version 1.0 (16 January 2020), Core, CT.PO-P1
Text version: NIST Privacy Framework 1.0 Core, 16 January 2020 (not PF 1.1)
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- NIST PF 1.0 Target Profile adopted: YES
- CT.PO-P: Which outcomes are selected in this project's Target Profile? is CT.PO-P1
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Identities/credentials are issued, verified, and revoked; users, services, and devices are authenticated (MFA where risk warrants)
- Access permissions enforce least privilege and separation of duties and are reviewed periodically
- Access to personal data is role-based and limited to individuals who require it for their function
- Physical/remote access and network integrity (segmentation) are managed
- Access grants, changes, and revocations are logged and auditable
Questions people ask
- Does NIST PF CT.PO-P1 - Processing authorization policies (focused outcome view) apply to my service?
- It applies when NIST PF 1.0 Target Profile adopted: YES; CT.PO-P: Which outcomes are selected in this project's Target Profile? is CT.PO-P1.
- From when does this apply?
- NIST PF CT.PO-P1 - Processing authorization policies (focused outcome view) applies from 16 January 2020. Its current status is: in force.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.