HITRUST CSF

The CSF organizes its controls into 19 domains that map directly to ISO 27001 and other authoritative sources. Each domain addresses a specific operational area:

• Information Protection Program: Governance and policy management
• Endpoint Protection: Malware defenses and mobile device security
• Portable Media Security: USB and removable storage controls
• Physical and Environmental Security: Data center and facility safeguards
• Access Control: Role-based and session-level authentication
• Incident Management: Detection, response, and reporting procedures
• Business Continuity and Disaster Recovery: Resilience planning
• Risk Management: Formal risk assessment and treatment processes
• Third-Party Assurance: Vendor and business associate oversight

Unlike binary compliance checklists, HITRUST evaluates controls on a five-level maturity scale based on the PRISMA model:

• Level 1 (Policy): The control is documented in a formal policy
• Level 2 (Procedure): A detailed procedure operationalizes the policy
• Level 3 (Implemented): The procedure is actively executed and evidence exists
• Level 4 (Measured): Control effectiveness is quantitatively tracked and reviewed
• Level 5 (Managed): Continuous improvement is driven by metrics and lessons learned

Most validated assessments require achieving Level 3 across all applicable controls.

The CSF tailors control applicability using organizational, system, and regulatory risk factors. This ensures a small ambulatory clinic and a multi-state health system are assessed differently:

• Organizational Factors: Annual revenue, number of employees, geographic footprint
• System Factors: Volume of PHI stored, number of system users, integration complexity
• Regulatory Factors: Applicable laws beyond HIPAA, such as state breach notification statutes or FTC Red Flags Rule
• Inheritance: Controls managed by a parent entity or cloud provider can be inherited, reducing direct assessment scope

HITRUST offers three assessment tiers with escalating rigor, each producing a different report type:

• e1 (Essentials): A self-assessment with 44 foundational controls, suitable for low-risk organizations demonstrating basic cyber hygiene
• i1 (Implemented): A validated assessment with 182 controls, requiring an approved external assessor to verify control implementation
• r2 (Risk-Based): The most rigorous, comprehensive validated assessment covering the full CSF based on scoping factors, historically required for high-risk entities

Each tier generates a HITRUST Validated Report with a corrective action plan for any gaps identified.

When a control is scored below the required maturity level, a Corrective Action Plan is generated. This is not a failure but a structured remediation roadmap:

• Each gap is assigned a severity rating (Minor, Moderate, Major)
• A remediation timeline is established, typically 90 days for validated assessments
• Evidence of remediation is submitted through the MyCSF platform for assessor review
• The CAP is tracked across assessment cycles, demonstrating a commitment to continuous compliance maturity

All HITRUST assessment activity is managed through MyCSF, a SaaS platform that serves as the system of record:

• Control scoring and evidence upload with version tracking
• Assessor workflow for independent validation and quality assurance
• Inheritance catalog for reusing control assessments from cloud providers like AWS and Azure
• Regulatory mapping that dynamically links CSF controls to HIPAA, PCI DSS, GDPR, and other mandates
• Reporting dashboard that generates the HITRUST Validated Report and executive summary