NIST Privacy Framework maps risk—not local records law
NIST presents the framework as a voluntary enterprise-risk tool, while its site identifies Version 1.1 as an initial public draft. Neither status supplies a municipality's governing disclosure, retention, or records rule.