NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
Risk Assessment and Data Inventory
NRF Cybersecurity and Data Privacy Framework (National Retail Federation) NRFCS-2: Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model
Conduct retail-tailored risk assessment + customer data inventory + classification per the NRF framework + NIST SP 800-30 Rev 1 + adaptation to retail threat model. Customer data inventory must enumerate (a) data types collected (loyalty + transaction + browsing + clickstream + mobile location + in-store sensor + camera + payment + employee + supplier + business operations data), (b) sources (POS + e-commerce site + mobile app + email signup + in-store kiosk + loyalty programme + customer service interaction + supplier portal + third-party data brokers + warranty / registration data + market research), (c) processing locations (data centres + cloud + retail stores + warehouses + distribution centres + supplier facilities + third-party processors + cross-border transfers), (d) retention periods + deletion procedures + data subject rights compliance per applicable jurisdiction. Classification must apply data-type + sensitivity + regulatory triggers (cardholder data per PCI DSS + personal information per state privacy laws + sensitive personal information including health from over-the-counter pharmacy + biometric from in-store technology + children data from children product lines + financial information). Retail threat model must address (a) point-of-sale malware + skimmers + e-commerce site skimmers (Magecart + form-jacking), (b) account takeover via credential stuffing + phishing + SIM swap, (c) supply chain compromise via vendor breach + counterfeit goods + return fraud, (d) insider threat including loss prevention + temporary peak-season workforce + contractors, (e) ransomware targeting retail during peak shopping periods.
What else in your programme already covers this
This control maps to 222 controls across 94 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use