Search - FAQs

What is the difference between a HITRUST External Assessor and a Certified CSF Practitioner (CCSFP)?

External Assessor Program FAQ » What is the difference between a HITRUST External Assessor and a Certified CSF Practitioner (CCSFP)?

A Certified CSF Practitioner is an individual that has completed the required training, passed an exam, and meets the experience requirements for a practitioner. A HITRUST External Assessor is a firm that has met all the requirements to become authorized to perform…

What is the difference between a HITRUST practitioner and a HITRUST External Assessor?

External Assessor Program FAQ » What is the difference between a HITRUST practitioner and a HITRUST External Assessor?

HITRUST External Assessors are designated organizations qualified to provide assessments for clients seeking HITRUST Certification. HITRUST practitioners are either members of a HITRUST Assessor organization that have obtained this status through the HITRUST training…

What is the difference between the HITRUST Scorecard of the NIST Cybersecurity Framework and the HITRUST CSF Certification?

HITRUST CSF and NIST CSF Frequently Asked Question » What is the difference between the HITRUST Scorecard of the NIST Cybersecurity Framework and the HITRUST CSF Certification?

HITRUST CSF Certification is based on an organization meeting specific scoring criteria for the assessed requirements aggregated into 19 topical domains, e.g., access control and wireless network security. The scorecard HITRUST uses to support certification of an…

What is the difference between a HITRUST CSF Certification and a service auditor’s report expressing an opinion on the fairness of the system description, suitability of design, and operating effectiveness of controls based on The HITRUST CSF?

HITRUST CSF and SOC 2® Frequently Asked Questions » What is the difference between a HITRUST CSF Certification and a service auditor’s report expressing an opinion on the fairness of the system description, suitability of design, and operating effectiveness of controls based on The HITRUST CSF?

See the question “In the future, it looks like the SOC 2 HITRUST certification will only assess 75 controls. Does that mean organizations will not have to certify?”

What is the HITRUST CSF Assurance Program?

CSF Assurance Program FAQ » What is the HITRUST CSF Assurance Program?

The HITRUST CSF Assurance program is a common, standardized methodology to effectively and consistently measure compliance and risk via simplified information collection and reporting, consistent testing procedures and scoring, and demonstrable efficiencies and…

What is the relationship between the controls categories of the HITRUST CSF and the assessment domains found in MyCSF?

HITRUST CSF Framework FAQ » What is the relationship between the controls categories of the HITRUST CSF and the assessment domains found in MyCSF?

The simple answer is that there is no relationship between the HITRUST CSF control categories and the assessment domains. The HITRUST CSF control categories were derived from ISO and provide the structure for the framework. The assessment domains take the control…

What is the HITRUST CSF Assurance Program?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » What is the HITRUST CSF Assurance Program?

Designed to meet the unique regulatory and business needs of the healthcare industry, the HITRUST CSF Assurance Program provides a common, standardized methodology to effectively and consistently measure compliance and risk via simplified information collection and…

Is a HITRUST CSF assessment a requirement for certification against the NIST Cybersecurity Framework, or can I just obtain a HITRUST certification for the NIST Cybersecurity Framework? If so, what is the cost?

HITRUST CSF and NIST CSF Frequently Asked Question » Is a HITRUST CSF assessment a requirement for certification against the NIST Cybersecurity Framework, or can I just obtain a HITRUST certification for the NIST Cybersecurity Framework? If so, what is the cost?

Yes, a HITRUST CSF assessment is a requirement for certification against the NIST Cybersecurity Framework. This is because the HITRUST CSF provides the detailed requirements an organization should implement to adequately address the cybersecurity objectives—what…

What controls are included in both a HITRUST CSF Certification and HITRUST’s certification for the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » What controls are included in both a HITRUST CSF Certification and HITRUST’s certification for the NIST Cybersecurity Framework?

An organization selects an appropriate set of security control requirements for its information protection program based on its organizational, system and regulatory risk factors, and it is this set of control requirements that constitute its NIST Cybersecurity…

Is the HITRUST CSF Assurance Program a one-size-fits-all approach?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Is the HITRUST CSF Assurance Program a one-size-fits-all approach?

As we’ve seen, the CSF is not a one-size-fits-all approach due to (1) an organization’s ability to tailor the initial selection of the control baseline in accordance with defined risk factors and (2) the requirement for additional tailoring based on unique threats,…

What is the process for an organization to achieve HITRUST CSF Certification?

CSF Assurance Program FAQ » What is the process for an organization to achieve HITRUST CSF Certification?

Before starting the Certification process, HITRUST recommends a self-assessment or readiness assessment be performed to prepare organizations for the validated assessment. To begin the Certification process, please select a HITRUST Assessor. Once you select an…

What is the process for an organization to achieve HITRUST CSF Certification?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » What is the process for an organization to achieve HITRUST CSF Certification?

Before starting the certification process, HITRUST recommends a self-assessment or readiness assessment be performed to prepare organizations for the validated assessment. To begin the certification process, please select a HITRUST Assessor. Once you select an…

What is the length of time it takes to become HITRUST CSF Certified?

CSF Assurance Program FAQ » What is the length of time it takes to become HITRUST CSF Certified?

CSF Certification can be achieved when the minimum compliance level (a score of 3+ or 3 with corrective action plans) is met for all 75 CSF controls required for certification (2019 CSF v9.2 requirement). The total amount of time it can take an organization to become…

We are working on a self-assessment on version 9.1 of the HITRUST CSF, what will change for us?

MyCSF FAQ » We are working on a self-assessment on version 9.1 of the HITRUST CSF, what will change for us?

Nothing. We advise scheduling your conversion after you have finished any active assessments to help ensure a smooth migration.

The HITRUST CSF FAQ

Frequently Asked Questions About the HITRUST Risk Management Framework » The HITRUST CSF FAQ

Subtopics Why does healthcare need a security framework? What were the industry’s goals for the CSF? Does the CSF take a “one-size-fits-all” approach to information security? Is the scope of the CSF too large for most healthcare organizations? Why choose…

Is a HITRUST CSF validated assessment more expensive than comparable assessments?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Is a HITRUST CSF validated assessment more expensive than comparable assessments?

No, and this is a common misconception. In many cases the overall assessment costs associated with information security and privacy assessments conducted under the HITRUST CSF Assurance Program are less than other third-party assessments. The alignment between the…

Why did HITRUST map the threats to HITRUST CSF v10 and not the CSF v9.x?

HITRUST Threat Catalogue FAQ » Why did HITRUST map the threats to HITRUST CSF v10 and not the CSF v9.x?

HITRUST is developing the Threat Catalogue as part of the upcoming HITRUST CSF v10 release anticipated in Q1/Q2 2019. The Nov 2018 early release is being provided to the user community as part of a concerted effort to elicit feedback from the public and further…

Does a SOC 2 + HITRUST CSF examination assess all 135 or only the controls required for HITRUST certification?

HITRUST CSF and SOC 2® Frequently Asked Questions » Does a SOC 2 + HITRUST CSF examination assess all 135 or only the controls required for HITRUST certification?

The answer to this question is either. HITRUST has updated the SOC 2 + HITRUST guidance to illustrate how a SOC 2 + HITRUST CSF opinion could be based upon all 135 security CSF Controls or only those security controls required for Certification. There are three (3)…

How does my firm become a HITRUST Assessor?

External Assessor Program FAQ » How does my firm become a HITRUST Assessor?

To become an External Assessor, organizations must meet certain requirements set forth by HITRUST to ensure adequate knowledge, training and expertise. The process for becoming an External Assessor includes the following steps: 1. Complete and submit an External…

When is the HITRUST CSF v10.0 being released?

MyCSF FAQ » When is the HITRUST CSF v10.0 being released?

HITRUST CSF v10.0 will be released 4Q 2019.

How many organizations have completed a HITRUST CSF assessment?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » How many organizations have completed a HITRUST CSF assessment?

38,000 CSF Assessments have been performed in the last three years with 15,000 CSF Assessments in 2015 alone. HITRUST anticipates a continued demand for CSF Certification due to third-party assurance requirements from several major health organizations and requests for…

How many organizations have completed a HITRUST CSF Assessment?

CSF Assurance Program FAQ » How many organizations have completed a HITRUST CSF Assessment?

38,000 CSF Assessments have been performed in the last three years with 15,000 CSF Assessments in 2015 alone. HITRUST anticipates a continued demand for CSF Certification due to third-party assurance requirements from several major health organizations and requests for…

Do I need to attend HITRUST training every year to maintain my status as a HITRUST Practitioner?

External Assessor Program FAQ » Do I need to attend HITRUST training every year to maintain my status as a HITRUST Practitioner?

HITRUST practitioners will complete the onsite training during the first year. The second and third year they are required to complete a refresher. The CSF Practitioner Refresher Course is a self-paced online course available for download from the HITRUST Academy. The…

What makes HITRUST a valid organization for issuing a certification for the NIST Cybersecurity Framework certification?

HITRUST CSF and NIST CSF Frequently Asked Question » What makes HITRUST a valid organization for issuing a certification for the NIST Cybersecurity Framework certification?

ANSI estimates there are hundreds of ‘traditional’ standards developing organizations (or “SDOs”) in the United States and hundreds more ‘non-traditional’ standards development bodies, such as consortia. The HITRUST Alliance is one of these industry SDOs…

How does the definition of a mature organization correspond to the scores required for HITRUST CSF® Certification?

Control Maturity and Continuous Monitoring and Assessment FAQ » How does the definition of a mature organization correspond to the scores required for HITRUST CSF® Certification?

Mature organizations are defined as those organizations with ‘best-in-class’ information protection programs that not only have robust policies and procedures in place to support full implementation of their information security and privacy controls—a complete…

How is HITRUST and covered entities engaging with the HITRUST Third Party Assurance?

Third Party Assurance FAQ » How is HITRUST and covered entities engaging with the HITRUST Third Party Assurance?

HITRUST formed a Business Associate Council in March 2016. The Council was established to ensure healthcare industry business associates and other key vendors are able to influence and directly engage with HITRUST, healthcare organization relating to the HITRUST Third…

HITRUST CSF and NIST CSF Frequently Asked Question

Subtopics Why should my organization get a certification relating to the NIST Cybersecurity Framework? How can an organization communicate it has obtained a HITRUST certification for the NIST Cybersecurity Framework? Does NIST recognize HITRUST as a certifying…

Is HITRUST’s certification for the NIST Cybersecurity Framework separate from HITRUST CSF Certification?

HITRUST CSF and NIST CSF Frequently Asked Question » Is HITRUST’s certification for the NIST Cybersecurity Framework separate from HITRUST CSF Certification?

Yes, one certification is for the organization’s implementation of the HITRUST CSF controls and is based on minimum scoring criteria for 19 topical control areas, such as access control and wireless network security. The other is a certification of an…

Is there a fee for HITRUST to process the interim assessment?

Interim Review FAQ » Is there a fee for HITRUST to process the interim assessment?

Yes, there is a fee of $2,900 but this is waived for active MyCSF subscribers. The fee includes 60 days of access to MyCSF for non-subscribers to recreate and submit their interim assessment, processing of the interim assessment and, upon successful completion,…

If I’m HITRUST CSF Certified, what do I need to do to demonstrate I’m complying with the NIST CsF?

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ » If I’m HITRUST CSF Certified, what do I need to do to demonstrate I’m complying with the NIST CsF?

If you’re HITRUST CSF Certified, you can demonstrate compliance with the NIST CsF in one of two ways. An organization can generate a NIST CsF scorecard based on the maturity1 of the HITRUST CSF control requirements that support each of the NIST CsF Core…

HITRUST CSF Framework FAQ

Subtopics Why choose the CSF over other frameworks (NIST, ISO, etc.)? How do I get started adopting the CSF framework? How can I obtain a copy of the CSF? What is the cost to download the framework? How is the CSF structured? Is the CSF an industry standard for…

Is a HITRUST certification assessment more expensive than comparable assessments?

CSF Assurance Program FAQ » Is a HITRUST certification assessment more expensive than comparable assessments?

No, and this is a common misconception and in many cases the overall assessment costs associated with information security and privacy assessments are less than other 3rd party assessments. The alignment between the HITRUST CSF and CSF Assurance programs allows a…

Can any CPA firm issue a joint SOC 2/HITRUST CSF Certified report?

Third Party Assurance FAQ » Can any CPA firm issue a joint SOC 2/HITRUST CSF Certified report?

No. While a CPA firm can perform a SOC 2 based on the HITRUST CSF, per the requirements of the HITRUST CSF Assurance Program, only authorized assessors can issue reports that grant HITRUST CSF certification. We currently have a growing list of over 75 assessor firms.…

What would prompt HITRUST to issue additional HITRUST CSF implementation guidance?

HITRUST Threat Catalogue FAQ » What would prompt HITRUST to issue additional HITRUST CSF implementation guidance?

A HITRUST Implementation Advisory would be issued if there is additional clarification around how HITRUST CSF requirements should be implemented to effectively address one or more threats—or as an interim measure until more stringent or enhanced control requirements…

HITRUST CSF and SOC 2® Frequently Asked Questions

Subtopics Does a SOC 2 + HITRUST CSF examination assess all 135 or only the controls required for HITRUST certification? What is the difference between a HITRUST CSF Certification and a service auditor’s report expressing an opinion on the fairness of the system…

How will HITRUST use threat intelligence to update the requirements in the HITRUST CSF?

HITRUST Threat Catalogue FAQ » How will HITRUST use threat intelligence to update the requirements in the HITRUST CSF?

By understanding the control requirements in the HITRUST CSF that are intended to address specific threats identified in threat intelligence, HITRUST will gain greater insight into how they are adequately addressed based on current industry accepted (aka “best”)…

If I am already HITRUST CSF Certified, how do I get a copy of my certification for the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » If I am already HITRUST CSF Certified, how do I get a copy of my certification for the NIST Cybersecurity Framework?

A scorecard and certification for the NIST Cybersecurity Framework can be generated against a prior assessment against HITRUST CSF v9 and v9.1. Cost of the additional scorecard is $500. For more information, contact HITRUST by email at sales@hitrustalliance.net or by…

What is the role of continuous monitoring in the HITRUST scoring process?

Control Maturity and Continuous Monitoring and Assessment FAQ » What is the role of continuous monitoring in the HITRUST scoring process?

Information security continuous monitoring (ISCM) has been a part of the HITRUST CSF control maturity and scoring model since the inception of the HITRUST CSF Assurance Program in 2009. Typical assessment and audit approaches generally focus on policy and…

If I’ve already adopted the HITRUST CSF, does that mean I’ve adopted the NIST CsF?

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ » If I’ve already adopted the HITRUST CSF, does that mean I’ve adopted the NIST CsF?

Yes, you’re well on your way as the HITRUST Risk Management Framework (RMF)—consisting of the HITRUST CSF, CSF Assurance Program and related method and tools—is the foundation for a model implementation of the NIST CsF in the private sector.1 Since the NIST…

Frequently Asked Questions About the HITRUST Risk Management Framework

Founded in 2007, HITRUST Alliance is a not-for-profit organization whose mission is to champion programs that safeguard sensitive information and manage information risk for organizations across all industries and throughout the third-party supply chain. In…

HITRUST and the NIST Cybersecurity Framework FAQ

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ

Subtopics Can risk be calculated based on a control’s maturity level? Do non-contextual impact ratings for controls provide any real value? How does the RMF fit into the NIST CsF? Why can’t I just adopt the NIST CsF without leveraging additional guidance or…

How does the HITRUST Threat Catalogue make the HITRUST CSF better or improve its ability to help manage risk?

HITRUST Threat Catalogue FAQ » How does the HITRUST Threat Catalogue make the HITRUST CSF better or improve its ability to help manage risk?

By identifying and mapping threats to HITRUST CSF controls based on their specifications, HITRUST will have additional visibility into how the controls mitigate associated risk. This will help ensure the risks associated with specific threats are addressed…

How often do I need to get a HITRUST CSF assessment report to support my third-party assurance requirements?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » How often do I need to get a HITRUST CSF assessment report to support my third-party assurance requirements?

HITRUST CSF Validated Reports with Certification are valid for two years given the successful completion of an interim review (typically 12 months after the original assessment), that no breach and no significant changes have occurred relating to the scoped control…

If we have already completed the evidence sampling and review with our HITRUST assessor firm, do we need to use the memorandum interim submission or the HITRUST MyCSF interim submission?

Interim Review FAQ » If we have already completed the evidence sampling and review with our HITRUST assessor firm, do we need to use the memorandum interim submission or the HITRUST MyCSF interim submission?

Interim assessments completed after April 1, 2019 need to adhere to the current guidelines, including submitting through MyCSF. The only exception is for organizations holding a certification on CSF v9.0 or prior versions – they can submit outside of MyCSF but…

Who will accept HITRUST CSF Assurance Reports?

CSF Assurance Program FAQ » Who will accept HITRUST CSF Assurance Reports?

Many organizations accept CSF Assurance reports as a means of evaluating a business partner’s privacy and security controls and in fact a growing number of organizations require their business partners obtain a CSF Certification.. Reference: HITRUST CSF Assurance…

Since ISO/IEC provides an internationally recognized information security standard, can I use my ISO 27001 certification to satisfy customer and business partner requirements for a HITRUST CSF Validated or Certified Report?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Since ISO/IEC provides an internationally recognized information security standard, can I use my ISO 27001 certification to satisfy customer and business partner requirements for a HITRUST CSF Validated or Certified Report?

The best discussion of why one would choose the HITRUST CSF over ISO 27001 and NIST SP 800-53 is provided in an earlier FAQ, but to address the question about accepting one in lieu of another, we’ll need to expand a little further. The biggest difference between the…

How can an organization communicate it has obtained a HITRUST certification for the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » How can an organization communicate it has obtained a HITRUST certification for the NIST Cybersecurity Framework?

As part of the HIITRUST CSF Assurance Program, upon receiving a HITRUST CSF Assessment Report, organizations may request a Press Kit with details on how they may publicly communicate their HITRUST CSF Certification status, which also includes certification of its…

Is attaching a w/p or policy required? I thought only the name of the evidence we collected was needed in the tool. After that, if QA’d by HITRUST, is the evidence needed?

MyCSF FAQ » Is attaching a w/p or policy required? I thought only the name of the evidence we collected was needed in the tool. After that, if QA’d by HITRUST, is the evidence needed?

There are several changes that will be announced relating to the Assurance Program requirements. These are independent of the HITRUST CSF and MyCSF and are designed to increase the consistency and integrity of the assurance process.

Is the CSF a compliance-based or risk-based framework?

HITRUST CSF Framework FAQ » Is the CSF a compliance-based or risk-based framework?

The CSF is a risk-based framework. To understand why, one must understand the intent of selecting and implementing any specified set of controls, whether it’s a custom set developed from a traditional risk analysis or one tailored from a pre-defined control baseline…

How can my organization utilize the HITRUST CSF framework for an AICPA SOC 2 report?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » How can my organization utilize the HITRUST CSF framework for an AICPA SOC 2 report?

HITRUST and AICPA collaborated on the mapping of HITRUST CSF controls to AICPA Trust Principles and Criteria for Security, Confidentiality and Availability. Subsequently, any AICPA firm can perform a SOC 2 examination leveraging the CSF framework. This allows the…

Are HITRUST assessments only useful for formal certification against the CSF?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Are HITRUST assessments only useful for formal certification against the CSF?

Certification is only one of the ways the HITRUST CSF can be used. Not all organizations need to pursue certification, and validation will provide assurances that specific controls are implemented, which ones are not or may have been changed, and how well they are…

Will HITRUST provide a webinar specifically for assessors and practitioners? How do practitioners see customer comments, the evidence cited and how will assessors and practitioners provide comments?

MyCSF FAQ » Will HITRUST provide a webinar specifically for assessors and practitioners? How do practitioners see customer comments, the evidence cited and how will assessors and practitioners provide comments?

Yes. We will be revising the full and refresher training courses. These can be taken through our LMS and will walk assessors through the process. We intend to make this module available to all CCSFPs.

How does threat intelligence linked to the HITRUST CSF help me better protect health information?

HITRUST Threat Catalogue FAQ » How does threat intelligence linked to the HITRUST CSF help me better protect health information?

By linking granular threats identified in active threat intelligence to (1) higher-level threats contained in the HITRUST Threat Catalogue and (2) related HITRUST CSF controls, organizations will gain greater insight into how well they are addressing extant and…

How does the HITRUST Threat Catalogue help me perform a risk analysis?

HITRUST Threat Catalogue FAQ » How does the HITRUST Threat Catalogue help me perform a risk analysis?

By understanding how HITRUST CSF controls address specific threats to personal data and other sensitive information, an organization can demonstrate the results of the risk analyses used by the underlying control frameworks in the HITRUST CSF, e.g., ISO 27002, NIST SP…

Do HITRUST Certification programs provide safe harbor in the event of a breach?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Do HITRUST Certification programs provide safe harbor in the event of a breach?

Certification is not required by any regulatory body, nor has any regulatory body sanctioned certification as a mechanism to provide safe harbor in the event of a breach. This is true not just for the HITRUST CSF but for other standards and frameworks as they apply to…

If I am HITRUST CSF Certified, am I also certified for the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » If I am HITRUST CSF Certified, am I also certified for the NIST Cybersecurity Framework?

HITRUST CSF Certification will generally result in certification of an organization’s information security program against the NIST Cybersecurity Framework because the control requirements for both frameworks are essentially the same; they’re just mapped and…

Does NIST recognize HITRUST as a certifying organization?

HITRUST CSF and NIST CSF Frequently Asked Question » Does NIST recognize HITRUST as a certifying organization?

Although NIST does not have its own certification program for the Cybersecurity Framework, NIST does recognize and actually encourage third party programs that provide a “confidence mechanism” for an organization’s implementation of the Framework, which also…

Can I get certified against the NIST Cybersecurity Framework even if I don’t meet the requirements for HITRUST CSF certification?

HITRUST CSF and NIST CSF Frequently Asked Question » Can I get certified against the NIST Cybersecurity Framework even if I don’t meet the requirements for HITRUST CSF certification?

While it’s possible, the likelihood that an organization can be certified against the NIST Cybersecurity Framework without meeting the requirements for HITRUST CSF certification are very small. This is because each certification is based on a single assessment. …

Is the HITRUST certification for the NIST Cybersecurity Framework just for healthcare?

HITRUST CSF and NIST CSF Frequently Asked Question » Is the HITRUST certification for the NIST Cybersecurity Framework just for healthcare?

No, HITRUST certification of an organization’s implementation of the NIST Cybersecurity Framework—just like HITRUST CSF certification—can be obtained by any organization, regardless of industry or whether they are US-based or international.

For organizations that have already started their assessment, will their current identified requirements be automatically populated into the new MyCSF tool to ensure no mismatch between HITRUST provided requirements and ones generated by the tool?

MyCSF FAQ » For organizations that have already started their assessment, will their current identified requirements be automatically populated into the new MyCSF tool to ensure no mismatch between HITRUST provided requirements and ones generated by the tool?

If you are a subscribing customer, actively preforming an assessment and going through the validation process, we recommend delaying your migration until you complete that process. All of your data will be migrated over to MyCSF 2.0.

What is the best approach for implementing the NIST CsF in the healthcare industry?

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ » What is the best approach for implementing the NIST CsF in the healthcare industry?

The best approach for implementing the NIST Framework for Improving Critical Infrastructure Cybersecurity,1 or Cybersecurity Framework (CsF), is the approach outlined in the Healthcare Sector Cybersecurity Framework Implementation Guide,2 produced and published under…

Will HITRUST incorporate the NIST Cybersecurity Practice Guides into the HITRUST RMF?

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ » Will HITRUST incorporate the NIST Cybersecurity Practice Guides into the HITRUST RMF?

HITRUST works closely with NIST and we constantly analyze their documentation to see what additional guidance can be utilized. Many guidelines—most often those that are very technical or technology-specific—are typically outside the scope of the HITRUST CSF;…

If I’m HITRUST CSF Certified, does that mean I’m HIPAA compliant?

CSF Assurance Program FAQ » If I’m HITRUST CSF Certified, does that mean I’m HIPAA compliant?

In principle yes, but it is not black and white. To be HIPAA-compliant, an organization must conduct a risk analysis and implement a reasonable and appropriate set of information safeguards—aka information security controls—to provide for the adequate protection of…

How is the CSF structured?

HITRUST CSF Framework FAQ » How is the CSF structured?

HITRUST recognized the global nature of healthcare and the need to gain assurances around the protection of covered information from non-U.S. business associates, which led to the International Organization for Standardization and International Electrotechnical…

If I’m HITRUST CSF certified, does that mean I’m HIPAA-compliant?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » If I’m HITRUST CSF certified, does that mean I’m HIPAA-compliant?

To be HIPAA-compliant, an organization must conduct a risk analysis and implement a reasonable and appropriate set of information safeguards—aka information security controls—to provide for the adequate protection of ePHI against all reasonably anticipated threats.…

Will HITRUST Assessors be assessing against the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » Will HITRUST Assessors be assessing against the NIST Cybersecurity Framework?

Yes, this is done automatically because the same control requirements evaluated by the HITRUST Assessor for HITRUST CSF Certification are also used for certification of the organization’s NIST Cybersecurity Framework implementation. The control requirements are…

How will the HITRUST Threat Catalogue evolve over time?

HITRUST Threat Catalogue FAQ » How will the HITRUST Threat Catalogue evolve over time?

HITRUST anticipates the HITRUST Threat Catalogue will be a “living document” due to the constantly changing threat environment, including planned improvements to better facilitate risk analyses and the consumption of threat intelligence. Changes will likely include…

I have started an interim assessment with my assessor organization. Should I stay on My CSF 1.0 until that is complete or switch over to My CSF 2.0? We have about two months for completion of the interim assessment.

MyCSF FAQ » I have started an interim assessment with my assessor organization. Should I stay on My CSF 1.0 until that is complete or switch over to My CSF 2.0? We have about two months for completion of the interim assessment.

Yes. Complete your interim in MyCSF 1.0 and the next cycle around it will be done in MyCSF 2.0.

What are the costs associated with the Assessor program?

External Assessor Program FAQ » What are the costs associated with the Assessor program?

There are three costs associated with the HITRUST External Assessor Program: Application fee (one-time payment of $2,500) Training fee: Five people must complete the CCSFP Course – $3,000 per individual, or Two of those Five must complete the CHQP Course…

How can I obtain a copy of the CSF?

HITRUST CSF Framework FAQ » How can I obtain a copy of the CSF?

The latest version of the CSF framework is available on our website for qualified organizations. A qualified organization is defined as any organization employing a function or activity involving the use or disclosure of individually identifiable health information,…

HITRUST Threat Catalogue FAQ

Subtopics How do I explain the HITRUST Threat Catalogue™ to my executives? Why did HITRUST map the threats to HITRUST CSF v10 and not the CSF v9.x? How does the HITRUST Threat Catalogue make the HITRUST CSF better or improve its ability to help manage risk? Can…

Will the HITRUST Threat Catalogue help me with HIPAA compliance?

HITRUST Threat Catalogue FAQ » Will the HITRUST Threat Catalogue help me with HIPAA compliance?

By enumerating common threats and, when available, common vulnerabilities, an organization will have additional information to support a risk analysis consistent with NIST and HHS recommendations, which requires an “accurate and thorough assessment of the potential…

How often will the HITRUST Threat Catalogue be updated?

HITRUST Threat Catalogue FAQ » How often will the HITRUST Threat Catalogue be updated?

We anticipate updates to occur annually, shortly after each HITRUST CSF release, or when significant changes in the threat environment would warrant an interim release.

What credit do customers of HITRUST get for achieving mature scorecards? When will this take effect?

Control Maturity and Continuous Monitoring and Assessment FAQ » What credit do customers of HITRUST get for achieving mature scorecards? When will this take effect?

Based on an analysis of CSF Assessment data collected over a 10-year period, HITRUST has concluded that when an organization’s controls within scope of a CSF Assessment are operated at or above an aggregated HITRUST CSF maturity score of 79, there is a very high…

How does a CSF assessment meet the HIPAA requirement for a risk analysis, and can it be used to support an OCR audit?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » How does a CSF assessment meet the HIPAA requirement for a risk analysis, and can it be used to support an OCR audit?

HITRUST bases its framework on how risk management is defined, i.e., the process of managing risk to organizational operations, organizational assets or individuals resulting from the operation of an information system (the definition of which is quite broad), and…

What HITRUST maturity scores should senior management or Boards of Directors mandate for their organization?

Control Maturity and Continuous Monitoring and Assessment FAQ » What HITRUST maturity scores should senior management or Boards of Directors mandate for their organization?

The level of maturity an organization wishes to pursue is a risk-based decision based on the needs of that organization. However, an industry-accepted level of due diligence and due care would be a fully implemented HITRUST CSF-based information protection program…

Will all the threats to personal data be listed in the HITRUST Threat Catalogue?

HITRUST Threat Catalogue FAQ » Will all the threats to personal data be listed in the HITRUST Threat Catalogue?

The HITRUST Threat Catalogue’s initial release is focused on providing as comprehensive a list as possible. However, users of the HITRUST Threat Catalogue should keep in mind that the threats are enumerated at a level consistent with the control specification in the…

Will the validation of all maturity scores and related evidence be examined by HITRUST or will that only apply to scores that are measured and managed scores?

Interim Review FAQ » Will the validation of all maturity scores and related evidence be examined by HITRUST or will that only apply to scores that are measured and managed scores?

The interim assessment is performed against a random sample of control requirements. They will be assessed against all maturity domains and HITRUST will review all maturity domains of the sampled control requirements. In addition, control requirements that generated…

Does HITRUST rely too heavily on the Assessor’s opinion of control effectiveness?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Does HITRUST rely too heavily on the Assessor’s opinion of control effectiveness?

Assessors and auditors generally determine control effectiveness regardless of what controls are specified, albeit there is usually a negotiation between the auditor/assessor and the organization before the final report is issued. However, assessors actually have more…

Does the use of alternate controls diminish the value of HITRUST Certification?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Does the use of alternate controls diminish the value of HITRUST Certification?

Alternate (or compensating) controls, by definition, mitigate a similar type and amount of risk as the control it’s intended to replace. This is illustrated in the Risk Analysis Guide for HITRUST Organizations and Assessors by an example proposing the extension of…

How can my organization utilize the CSF framework for a SOC 2 report?

HITRUST CSF Framework FAQ » How can my organization utilize the CSF framework for a SOC 2 report?

HITRUST and AICPA collaborated on the mapping of HITRUST CSF controls to AICPA Trust Principles and Criteria for Security, Confidentiality, and Availability. Subsequently, any AICPA firm can perform a SOC 2 examination leveraging the CSF framework which allows the…

What were the industry’s goals for the CSF?

Frequently Asked Questions About the HITRUST Risk Management Framework » The HITRUST CSF FAQ » What were the industry’s goals for the CSF?

Through HITRUST, the healthcare industry sought to create a control framework that was: Built specifically for the unique needs of healthcare Relevant through regular maintenance of supporting authoritative sources and changes in the threat environment Scalable to…

What are the various types of CSF Assessments?

CSF Assurance Program FAQ » What are the various types of CSF Assessments?

HITRUST offers two types of CSF Assessments: a self-assessment and a validated assessment. Self-assessment allows organizations to self-assess using the standard methodology, requirements, and tools provided under the CSF Assurance Program. HITRUST will then perform…

How do I explain the HITRUST Threat Catalogue™ to my executives?

HITRUST Threat Catalogue FAQ » How do I explain the HITRUST Threat Catalogue™ to my executives?

The HITRUST Threat Catalogue provides a comprehensive list of threats to ePHI and other types of PII and maps these threats to the HITRUST CSF® v10 control specifications intended to address them. It allows HITRUST® to better align HITRUST CSF requirements with…

Does the CSF take a “one-size-fits-all” approach to information security?

Frequently Asked Questions About the HITRUST Risk Management Framework » The HITRUST CSF FAQ » Does the CSF take a “one-size-fits-all” approach to information security?

The CSF is actually one of the most flexible information protection frameworks ever developed. First, the CSF was created by integrating multiple legislative, regulatory and leading practice guidelines and frameworks and tailoring the integrated requirements…

Does MyCSF 2.0 give organizations access to their vendors and their HITRUST certifications (or lack thereof)?

MyCSF FAQ » Does MyCSF 2.0 give organizations access to their vendors and their HITRUST certifications (or lack thereof)?

No. This functionality is part of the HITRUST Assessment XChange. For more information on the XChange, contact jacob.bustos@hitrustax.com.

Will the interim submission that will be conducted on the HITRUST portal be same/similar as full assessment or will it show only selected sample questions to be scored and validated?

Interim Review FAQ » Will the interim submission that will be conducted on the HITRUST portal be same/similar as full assessment or will it show only selected sample questions to be scored and validated?

The interim assessment will be performed against a random sample of requirements that will be selected at the time the interim assessment is generated. HITRUST will only process the selected sample but will verify, in cases where an object was recreated to ensure the…

Will HITRUST be incorporating the NIST Cybersecurity Practice Guides on Security Electronic Health Records on Mobile Devices?

HITRUST CSF Framework FAQ » Will HITRUST be incorporating the NIST Cybersecurity Practice Guides on Security Electronic Health Records on Mobile Devices?

HITRUST works closely with NIST and we constantly analyze their documentation to see what additional guidance can be utilized. Many guidelines—most often those that are very technical or technology-specific—are typically outside the scope of the HITRUST CSF,…

Is the CSF an industry standard for healthcare?

HITRUST CSF Framework FAQ » Is the CSF an industry standard for healthcare?

The CSF is not a standard in the same sense as ISO/IEC 27001:2013 and other, similar security standards given the CSF is a derivative work based on such standards. However, the CSF provides a consensus-driven standard of due care and due diligence for the protection of…

How are HITRUST report findings different than those from vendors like Security Scorecard and Bitsight?

Control Maturity and Continuous Monitoring and Assessment FAQ » How are HITRUST report findings different than those from vendors like Security Scorecard and Bitsight?

While useful, the approach used to obtain reputational scores like Security Scorecard and Bitsight is limited (similar to a narrowly scoped external penetration test) and is arguably unique for each organization’s network. It is further recognized that each scorecard…

How many organizations have adopted the CSF? Do you have a breakdown by type, size, location, etc.?

HITRUST CSF Framework FAQ » How many organizations have adopted the CSF? Do you have a breakdown by type, size, location, etc.?

The HITRUST CSF is the most widely adopted security framework in the healthcare industry: 81 percent of hospitals and 80 percent of health plans have adopted the framework in some way, either as a best practices resource or as the basis for their information protection…

What are the advantages of having a subscription to MyCSF?

MyCSF FAQ » What are the advantages of having a subscription to MyCSF?

To save time and costs A subscription enables clients to retain data, eliminating redundant (internal or assessor) data-entry tasks for the interim assessment and subsequent assessments saving organizations potentially hundreds of hours on a two-year assessment…

What types of assessments are available in the CSF Assurance Program?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » What types of assessments are available in the CSF Assurance Program?

HITRUST offers two types of CSF Assessments – a self-assessment and a validated assessment. Self-assessments allow organizations to assess themselves using HITRUST’s standard methodology, requirements, and tools provided under the CSF Assurance Program. HITRUST…

How many organizations have adopted the CSF? Do you have a breakdown by type, size, location, etc.?

Frequently Asked Questions About the HITRUST Risk Management Framework » The HITRUST CSF FAQ » How many organizations have adopted the CSF? Do you have a breakdown by type, size, location, etc.?

The HITRUST CSF is the most widely adopted security framework in the healthcare industry: 83 percent of hospitals and 82 percent of health plans with over 500,000 members have adopted the framework. HITRUST can provide detailed benchmarking data by request. If you have…

Is the scope of the CSF too large for most healthcare organizations?

Frequently Asked Questions About the HITRUST Risk Management Framework » The HITRUST CSF FAQ » Is the scope of the CSF too large for most healthcare organizations?

Although HITRUST specifically provides for significant tailoring of the CSF based on an organization’s specific risk factors, any framework can be applied inappropriately. An organization should not apply the CSF broadly unless it is scoped and tailored to the…

Is there a limit to the number of active assessments?

MyCSF FAQ » Is there a limit to the number of active assessments?

Yes. The number of assessments that an organization can have is limited by the level of access they have in MyCSF. Subscribing customers can purchase additional assessment objects in MyCSF if necessary.

Does a CSF Assurance assessment weight all controls equally?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Does a CSF Assurance assessment weight all controls equally?

Although all CSF controls placed in scope after the tailoring process must be implemented by the organization to effectively manage excessive residual risk, not all controls are assessed for a HITRUST CSF Validated or Certified Report. This is consistent with NIST…

What methods are used to evaluate the effectiveness of CSF controls?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » What methods are used to evaluate the effectiveness of CSF controls?

The HITRUST assessment methodology specifically requires: Assessors to gather and examine documentation (e.g., policies, procedures, records, logs, vulnerability assessment reports, risk assessment reports) Examine configuration settings, physical surroundings,…

Will you be able to produce the targeted assessment, i.e., PCI from the HITRUST assessment, for the questions that are the same?

MyCSF FAQ » Will you be able to produce the targeted assessment, i.e., PCI from the HITRUST assessment, for the questions that are the same?

No. A targeted assessment will be generated from the CSF library by pulling all requirements related to the targeted authoritative source. It will be a stand-alone assessment, but it can inherit from other assessments with the appropriate subscription…

Have scoping factors (e.g., environment use of mobile devices, accessible from a public location, etc.) changed between MyCSF 1.0 and 2.0?

MyCSF FAQ » Have scoping factors (e.g., environment use of mobile devices, accessible from a public location, etc.) changed between MyCSF 1.0 and 2.0?

No. The scoping factors are a function of the HITRUST CSF and not the version of MyCSF.

What is the cost to download the framework?

HITRUST CSF Framework FAQ » What is the cost to download the framework?

The cost to download the framework is FREE for qualified organizations.

External Assessor Program FAQ

Subtopics How does my firm become a HITRUST Assessor? What are the costs associated with the Assessor program? What is the difference between a HITRUST practitioner and a HITRUST External Assessor? Do I need to attend HITRUST training every year to maintain my…

With the ability to note which document goes with which maturity, will this eliminate the spreadsheet that the assessor is asked to provide outside of the portal?

MyCSF FAQ » With the ability to note which document goes with which maturity, will this eliminate the spreadsheet that the assessor is asked to provide outside of the portal?

The HITRUST assurance team will generate as much information for the reports from MyCSF as possible to minimize the manual and sometimes redundant collection of information.

Is a current SOC 2 acceptable for meeting the third-party assurance requirements?

Third Party Assurance FAQ » Is a current SOC 2 acceptable for meeting the third-party assurance requirements?

It depends. The accepting organization will need to make a determination based on the scope of the examination and the trust service criteria being reported upon. While the current SOC 2 may be granted a waiver and accepted in the first year, it will be necessary to…

Is an interim review required to maintain your HISTRUST CSF Certification for the NIST Cyber Security Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » Is an interim review required to maintain your HISTRUST CSF Certification for the NIST Cyber Security Framework?

No, the interim review requirement only applies to the HITRUST Certification.

Does CSF Assurance take a compliance-based approach to information protection?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Does CSF Assurance take a compliance-based approach to information protection?

From its inception, HITRUST chose to use a risk-based rather than compliance-based approach to information protection and help mature the healthcare industry’s approach to safeguarding information. By integrating NIST’s moderate-level control baseline into the…

Does a subscription add value if I am not getting CSF Certified?

MyCSF FAQ » Does a subscription add value if I am not getting CSF Certified?

Yes, even if you are only completing an assessment. Purchasing a subscription will open access to the MyCSF assessment, authoritative source reporting and will include a full, customizable view of the HITRUST CSF, advanced analytics for managing risk posture,…

Can we leverage MyCSF if we are looking to achieve HITRUST with SOC 2?

MyCSF FAQ » Can we leverage MyCSF if we are looking to achieve HITRUST with SOC 2?

The only way to efficiently tailor an assessment and generate the control requirements is in MyCSF. Organizations that are undergoing a SOC2 that is based on the HITRUST CSF can leverage MyCSF to make the process more efficient. This is the case even if only pursuing…

CSF Assurance Program and Certification FAQ

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ

Subtopics What is the HITRUST CSF Assurance Program? What types of assessments are available in the CSF Assurance Program? What is the process for an organization to achieve HITRUST CSF Certification? Is a HITRUST CSF validated assessment more expensive than…

Why choose the CSF over other control frameworks like NIST SP 800-53 and ISO/IEC 27001?

Frequently Asked Questions About the HITRUST Risk Management Framework » The HITRUST CSF FAQ » Why choose the CSF over other control frameworks like NIST SP 800-53 and ISO/IEC 27001?

Many of the elements for the argument are presented in FAQs throughout this section. But more specifically, the HITRUST CSF is specific to the healthcare industry, built and maintained by the healthcare industry, and simply better for the healthcare industry. Many of…

Does evidence always have to be referenced to the requirement for each assessed area (e.g., implementation, measured, managed) or can we say that we observed and explained what is being done?

MyCSF FAQ » Does evidence always have to be referenced to the requirement for each assessed area (e.g., implementation, measured, managed) or can we say that we observed and explained what is being done?

When possible, all evidence should be uploaded into MyCSF. This ensures a quick and consistent QA process. Failure to upload all evidence of testing will result in a “live” QA review by HITRUST via Webex.

Must the submission be performed by the assessed organization or the assessor firm as the full assessment or can the scores/comments be directly entered by one login and submitted?

Interim Review FAQ » Must the submission be performed by the assessed organization or the assessor firm as the full assessment or can the scores/comments be directly entered by one login and submitted?

The interim assessment must be completed by the assessed organization and then submitted to their assessor. The assessor must agree that all scores are accurate before generating the interim assessment. The assessor will submit the interim assessment to HITRUST once…

Has the CSF been adopted internationally?

HITRUST CSF Framework FAQ » Has the CSF been adopted internationally?

Yes, organizations outside of the U.S.—typically business associates providing services to U.S. healthcare organizations—have implemented the CSF. However, other countries have expressed an interest in HITRUST in the past, and we expect this interest to grow as…

What do I receive if I only purchase a report?

MyCSF FAQ » What do I receive if I only purchase a report?

Those purchasing a report and not a subscription to MyCSF will only have access to the MyCSF Assessment and Reports for authoritative sources such as HIPAA, SOC2, and HITRUST. Also, report-only access is limited to 90 days. Extensions of access may be purchased for an…

What is the MyCSF 2.0 QA process? How will the new process be different from the current process?

MyCSF FAQ » What is the MyCSF 2.0 QA process? How will the new process be different from the current process?

The only change to the QA process is that the process will be performed in MyCSF. There are other changes that are being implemented to the QA process that are focused on ensuring the integrity and consistency of the assurance program. These changes will be announced…

How does the RMF fit into the NIST CsF?

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ » How does the RMF fit into the NIST CsF?

The HITRUST RMF, which consists of the HITRUST CSF, CSF Assurance Program and supporting tools, methods and services, is actually a model implementation of the _NIST Framework for Improving Critical Infrastructure Cybersecurity _(also known as the NIST Cybersecurity…

Why choose the CSF over other frameworks (NIST, ISO, etc.)?

HITRUST CSF Framework FAQ » Why choose the CSF over other frameworks (NIST, ISO, etc.)?

The CSF integrates and harmonizes requirements from many authoritative sources such as ISO, NIST, PCI, HIPAA and others, and tailors the requirements to a healthcare organization based on specific organizational, system and regulatory risk factors. The level of…

How do I get started adopting the CSF framework?

HITRUST CSF Framework FAQ » How do I get started adopting the CSF framework?

First, the decision to adopt the CSF should be made at the organizational level, after which organizations should perform an internal gap analysis of existing controls against the target controls in the CSF. This analysis can be done manually or in HITRUST’s online…

Will businesses that require HITRUST Assessments for their third-party risk management programs expect their vendors to obtain higher maturity scores?

Control Maturity and Continuous Monitoring and Assessment FAQ » Will businesses that require HITRUST Assessments for their third-party risk management programs expect their vendors to obtain higher maturity scores?

HITRUST provides a common approach to triaging vendor risk by identifying the means and rigor of the assurances needed from a vendor based on the inherent information-related risks of a proposed or existing business relationship. This includes the information security…

How can my organization utilize the CSF framework for an AICPA SOC 2 report?

CSF Assurance Program FAQ » How can my organization utilize the CSF framework for an AICPA SOC 2 report?

HITRUST and AICPA collaborated on the mapping of HITRUST CSF controls to AICPA Trust Principles and Criteria for Security, Confidentiality, and Availability. Subsequently, any AICPA firm can perform a SOC 2 examination leveraging the CSF framework. This allows the…

How do I understand the CSF Assessment report I have received?

Third Party Assurance FAQ » How do I understand the CSF Assessment report I have received?

HITRUST has created a document that explains the assessment report, how to interpret, and how it can be used to compliment and enhance your current processes. Reference: Leveraging HITRUST CSF Assessment Reports: A Guide for New Users

Does the CSF Assurance Program support an “assess once, report many” approach?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Does the CSF Assurance Program support an “assess once, report many” approach?

HITRUST has recognized for some time that the current model used in the industry for Third-Party Assurance is fraught with inefficiencies and unnecessary costs by requiring duplicative questionnaires and assessments, which tend to distract organizations from monitoring…

CSF Assurance Program FAQ

Subtopics What is the HITRUST CSF Assurance Program? What are the various types of CSF Assessments? Is a HITRUST certification assessment more expensive than comparable assessments? What is the length of time it takes to become HITRUST CSF Certified? Who will…

How can I use the CSF Assurance Program for third-party risk management?

Third Party Assurance FAQ » How can I use the CSF Assurance Program for third-party risk management?

The HITRUST CSF Assurance Program is specifically designed to streamline the third-party risk management process by using a single comprehensive framework harmonizing multiple standards and leading practices to support a single assessment that may be reported out in…

Why can’t I just adopt the NIST CsF without leveraging additional guidance or frameworks?

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ » Why can’t I just adopt the NIST CsF without leveraging additional guidance or frameworks?

For an industry sector or organization to implement the _NIST Framework for Improving Critical Infrastructure Cybersecurity _(also known as the NIST Cybersecurity Framework, or NIST CsF), one must understand that it relies on existing standards, guidance, and leading…

How can I use the CSF Assurance Program for third-party risk management?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » How can I use the CSF Assurance Program for third-party risk management?

The HITRUST CSF Assurance Program is specifically designed to streamline the third-party risk management process by using a single comprehensive framework harmonizing multiple standards and leading practices to support a single assessment that may be reported out in…

Will those that just purchased a self-assessment then purchased the validated assessment be in the old version to start and the new version when they switch to the validated assessment?

MyCSF FAQ » Will those that just purchased a self-assessment then purchased the validated assessment be in the old version to start and the new version when they switch to the validated assessment?

Assess-only users should complete their assessments in the current environment. Keep in mind that if you have not purchased a subscription or access & retention with your assessment, your data will not be migrated and will be deleted 60 days after assessment access…

Do you support a hierarchy so that you can respond once on common controls like HR related items with the parent company and the responses go to all the sub assessments?

MyCSF FAQ » Do you support a hierarchy so that you can respond once on common controls like HR related items with the parent company and the responses go to all the sub assessments?

No. We do not have a hierarchy nor maintain any relationships between assessments. We encourage organizations to take advantage of the inheritance capability to achieve this.

In the questionnaire, can you select IT supplier, Healthcare, Payer, etc.? What are the other options?

MyCSF FAQ » In the questionnaire, can you select IT supplier, Healthcare, Payer, etc.? What are the other options?

The options are a function of the HITRUST CSF and will be updated to reflect more industry agnostic options with the release of HITRUST CSF v10.0.

Is there a release plan for customers who aren’t subscribers, but who just purchase assessment objects as needed?

MyCSF FAQ » Is there a release plan for customers who aren’t subscribers, but who just purchase assessment objects as needed?

No. For assess-only users, new assessment objects will be provisioned in MyCSF 2.0. Your data in MyCSF 1.0 will not be migrated and will be deleted 60 days after your assessment is complete. If you wish to maintain your data, you will need to purchase a subscription or…

What types of questions are there, and what information will we need to provide?

Third Party Assurance FAQ » What types of questions are there, and what information will we need to provide?

The HITRUST CSF Assessment questionnaire will ask about your organization’s information security practices in 19 major topical domains such as information protection program, endpoint protection, portable media security, third party assurance and risk management.…

What happens if I don’t meet the requirements for certification against the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » What happens if I don’t meet the requirements for certification against the NIST Cybersecurity Framework?

If an organization does not meet HITRUST CSF requirements for certification against the NIST Cybersecurity Framework, HITRUST will issue an assessment report with a Letter of Validation in lieu of a Letter of Certification.

Will a similar demo be done for assessors to understand the capabilities for assessors?

MyCSF FAQ » Will a similar demo be done for assessors to understand the capabilities for assessors?

Yes. We will be providing a demonstration targeted to assessors. Also, we will be making an online learning module available to all CCSFPs through the HITRUST Academy.

What are HITRUST’s requirements for certification of an organization’s information security program against the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » What are HITRUST’s requirements for certification of an organization’s information security program against the NIST Cybersecurity Framework?

Consistent with the certification requirements for the HITRUST CSF, an organization must achieve a minimum score for each NIST Cybersecurity Framework Core Category, which is aggregated from the scores for individual HITRUST CSF control requirements as they are mapped…

Why should my organization get a certification relating to the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » Why should my organization get a certification relating to the NIST Cybersecurity Framework?

There has been a marked increase in the level of interest by corporate Boards and executive management in using the NIST Cybersecurity Framework [“Framework”], which can provide a “Rosetta Stone” for internal and external stakeholders, regardless of industry or…

How long is HITRUST’s certification for the NIST Cybersecurity Framework valid?

HITRUST CSF and NIST CSF Frequently Asked Question » How long is HITRUST’s certification for the NIST Cybersecurity Framework valid?

HITRUST’s certification of the organization’s implementation of the NIST Cybersecurity Framework is for two (2) years, commensurate with the HITRUST CSF Assessment Report.

Do you need evidence for every requirement statement and domain like on a validated assessment?

Interim Review FAQ » Do you need evidence for every requirement statement and domain like on a validated assessment?

Yes, evidence is required for each selected control requirement in the interim assessment.

How is the existing validated assessment utilized for the interim review?

Interim Review FAQ » How is the existing validated assessment utilized for the interim review?

The interim review is generated from the original certified assessment object.

Can I get a HIPAA specific report?

MyCSF FAQ » Can I get a HIPAA specific report?

Yes. In MyCSF 2.0 there is the ability to generate a targeted assessment against any one of the authoritative sources. Targeted assessments will only generate scorecards within MyCSF and will not result in a HITRUST Assurance Report.

Why should I purchase a MyCSF subscription if I just need a report?

MyCSF FAQ » Why should I purchase a MyCSF subscription if I just need a report?

Purchasing a subscription will open access to the MyCSF assessment, authoritative source reporting and will include a full, customizable view of the HITRUST CSF, advanced analytics for managing risk posture, benchmarking data, ability to leverage the functionality to…

Who will need to subscribe for inheritance, the person receiving the inheritance, or the person providing it? Right now, the payor is not the person who benefits. Is that reversed now?

MyCSF FAQ » Who will need to subscribe for inheritance, the person receiving the inheritance, or the person providing it? Right now, the payor is not the person who benefits. Is that reversed now?

Anyone that wishes to allow their assessments to be inherited will need to subscribe. This applies to internal as well as external inheritance. External inheritance is viewed as a service that is provided to customers making it easier to assess if they are working with…

Can I get involved in the working group and, if so, how?

HITRUST Threat Catalogue FAQ » Can I get involved in the working group and, if so, how?

The HITRUST Threat Catalogue is currently overseen by the HITRUST CSF Advisory Council and is supported by a dedicated Working Group (WG) to help continue the development and maintenance of the HITRUST Threat Catalogue. Although the WG is not currently accepting new…

What will be different for the tool administrator in comparison to MyCSF 1.0?

MyCSF FAQ » What will be different for the tool administrator in comparison to MyCSF 1.0?

The only change is that it is fully integrated into MyCSF versus being its own application. There are no changes to how you administer MyCSF.

Is the back end of MyCSF 2.0 still RSAM? If so, will it impact the speed of processing?

MyCSF FAQ » Is the back end of MyCSF 2.0 still RSAM? If so, will it impact the speed of processing?

No. MyCSF 2.0 is not built upon any existing GRC technology and has been tuned to optimize performance.

How do you submit an assessment if you were certified against CSF v9.0 or prior versions?

Interim Review FAQ » How do you submit an assessment if you were certified against CSF v9.0 or prior versions?

HITRUST is granting exceptions for certifications obtained against HITRUST CSF v9.0. Since CSF v9.0 is not in the MyCSF tool, the assessment object cannot be recreated. Interim assessments meeting this criterion will be performed outside MyCSF, but non-subscribers…

Can assessors use sampling to improve the efficiency of the assessment?

Frequently Asked Questions About the HITRUST Risk Management Framework » CSF Assurance Program and Certification FAQ » Can assessors use sampling to improve the efficiency of the assessment?

Sampling methodologies can be a bit arcane, but sampling is actually very commonly used in the healthcare industry, especially by auditors. HITRUST also provides guidance to External Assessor organizations on the use of sampling in the HITRUST CSF Assessment…

How often do I need to get a report?

Third Party Assurance FAQ » How often do I need to get a report?

HITRUST CSF reports with Certification are valid for two years given the successful completion of an interim review, no breach has occurred and no significant changes have occurred relating to the scoped control environment. However, check with your business partner to…

Why does healthcare need a security framework?

Frequently Asked Questions About the HITRUST Risk Management Framework » The HITRUST CSF FAQ » Why does healthcare need a security framework?

For better or worse, the HIPAA Security Rule (HSR) applies to all covered entities and business associates regardless of their size, location or resources. Fortunately, the federal government recognized there is no ‘one-size-fits-all’ approach to securing sensitive…

Can I provide my ISO 27001 certification in lieu of CSF certification for third-party assurance?

Third Party Assurance FAQ » Can I provide my ISO 27001 certification in lieu of CSF certification for third-party assurance?

Organizations accepting ISO 27001 in lieu of CSF certification must still go through the traditional and demonstrably laborious process of comparing and contrasting what’s in the ISO report with what it expects from the comprehensive, prescriptive and often granular…

Can I get a free trial subscription or demo?

MyCSF FAQ » Can I get a free trial subscription or demo?

HITRUST does offer a free 2-week trial access in the MyCSF tool. This access is provided in a sandbox environment. This environment does not contain all of the functionality found in the production version of MyCSF and information input into this system will not…

Can risk be calculated based on a control’s maturity level?

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ » Can risk be calculated based on a control’s maturity level?

HITRUST evaluates likelihood based on an assessment of the control’s maturity level. To understand the approach, one must understand that a control framework is based on a broad risk analysis that considers threats to similar types of organizations for specific…

Does the interim assessment need to be submitted by the yearly certification date, or is there an allowance for submission up to 60 days late

Interim Review FAQ » Does the interim assessment need to be submitted by the yearly certification date, or is there an allowance for submission up to 60 days late

Interim assessments need to be submitted by the one-year anniversary of the certification date. Exceptions may be requested prior to the anniversary date to account for extraordinary circumstances that prohibit completion.

Control Maturity and Continuous Monitoring and Assessment FAQ

Subtopics How does the definition of a mature organization correspond to the scores required for HITRUST CSF® Certification? What HITRUST maturity scores should senior management or Boards of Directors mandate for their organization? What evidence do you have…

When will cyber threat intelligence be linked to the threats in the catalogue?

HITRUST Threat Catalogue FAQ » When will cyber threat intelligence be linked to the threats in the catalogue?

Once the mappings between threats and HITRUST CSF controls is completed, HITRUST will begin exploring ways to relate these mappings to the more granular threats identified in active threat intelligence. HITRUST anticipates this work will begin in…

Will there be a fee associated with API integration? Or a subscription level?

MyCSF FAQ » Will there be a fee associated with API integration? Or a subscription level?

Yes. This feature will only be available with certain subscription levels.

Do you have more information on the BASICs program? Can any organization participate or is there certain criteria that needs to be met?

MyCSF FAQ » Do you have more information on the BASICs program? Can any organization participate or is there certain criteria that needs to be met?

The BASICs program is targeted to lower risk organizations. We will be defining the criteria of lower risk and these criteria will need to be met to participate.

What’s included in HITRUST’s certification report for the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » What’s included in HITRUST’s certification report for the NIST Cybersecurity Framework?

HITRUST will issue a Letter of Certification for the NIST Cybersecurity Framework with a NIST CSF scorecard in the HITRUST CSF Assessment Report. HITRUST will also issue a separate Letter of Certification and scorecard that can be distributed separately from the…

Does the tool support organizations other than those in healthcare?

MyCSF FAQ » Does the tool support organizations other than those in healthcare?

Yes. MyCSF and the HITRUST CSF support organizations across all industries and globally.

The other types of assessments (GDPR, etc.) are only self-assessments and can’t be validated?

MyCSF FAQ » The other types of assessments (GDPR, etc.) are only self-assessments and can’t be validated?

Yes. We do not generate any type of assurance report for targeted assessments. There are assessments that you can perform internally, and you can generate score cards within the tool.

Will the documents and commenting from MyCSF 1.0 be transferred to MyCSF 2.0?

MyCSF FAQ » Will the documents and commenting from MyCSF 1.0 be transferred to MyCSF 2.0?

Yes. Customers who have a MyCSF subscription or access & retention will have their data migrated from MyCSF 1.0 to MyCSF 2.0.

What about modules such as policy management?

MyCSF FAQ » What about modules such as policy management?

MyCSF 2.0 will not provide the modules of Incident Management, Exception Management, or Policy Management. These modules will be sunset when all customers are migrated to MyCSF 2.0.

How many questions, and how long will it take?

Third Party Assurance FAQ » How many questions, and how long will it take?

The HITRUST CSF Security Assessment Questionnaire generally includes between 120 and 328 questions, depending on how the risk factors are configured for the organization being assessed. The amount of time it will take to complete the assessment varies depending on the…

APIs – which GRC tools will the APIs connect to? Will it allow the import of controls into the GRC tool and export from GRC response fulfillment into MyCSF 2.0?

MyCSF FAQ » APIs – which GRC tools will the APIs connect to? Will it allow the import of controls into the GRC tool and export from GRC response fulfillment into MyCSF 2.0?

The API allows use by many GRC tools. We are working with the largest players in the GRC market to develop guidance for the integration process. The current API deployment will allow for information to be extracted from MyCSF. In the future, you will be able to place…

Third Party Assurance FAQ

Subtopics How can I use the CSF Assurance Program for third-party risk management? How much does it cost to get a HITRUST CSF certification? How often do I need to get a report? How many questions, and how long will it take? How do I understand the CSF…

Do I have to perform my interim assessment in MyCSF?

Interim Review FAQ » Do I have to perform my interim assessment in MyCSF?

HITRUST is granting an exception for certifications obtained against HITRUST CSF v9.0 or earlier. Since CSF v9.0 and prior versions are not in the MyCSF tool, the assessment object cannot be recreated. Interim assessments meeting this criterion will be performed…

Will organizations be able to select which assessment version they use? Will you now be able to grandfather organizations into a previous assessment version if they completed their self-assessment on that version?

MyCSF FAQ » Will organizations be able to select which assessment version they use? Will you now be able to grandfather organizations into a previous assessment version if they completed their self-assessment on that version?

MyCSF 2.0 will be launched with CSF v9.1 in its library. It will have the feature to maintain multiple CSF versions and you will be able to take advantage of this once CSF v10.0 is released.

Can other types of assessments be done such as FISMA?

MyCSF FAQ » Can other types of assessments be done such as FISMA?

Yes. Targeted assessments can be performed against any of the authoritative sources of the HITRUST CSF. Targeted assessments are not submitted to HITRUST for validation and will not result in a HITRUST assurance report. They will only generate the appropriate scorecard…

MyCSF FAQ

Subtopics Why should I purchase a MyCSF subscription if I just need a report? Can I get a trial subscription or demo? What do I receive if I only purchase a report? What are the advantages of having a subscription to MyCSF? Does a subscription add value if I’m…

Will the new tool allow “partial” assessments to allow inheriting reusable component parts into new assessments? For example, can an object be built and assess only policies, then use that policy assessment to populate multiple system assessments?

MyCSF FAQ » Will the new tool allow “partial” assessments to allow inheriting reusable component parts into new assessments? For example, can an object be built and assess only policies, then use that policy assessment to populate multiple system assessments?

No. When you inherit a control requirement, it inherits scores related to all maturity domains based on the weight given to each. If you inherit from an object that has only scored policy, you will also be inheriting the zeros for the remaining maturity…

Interim Review FAQ

Subtopics My interim assessment is coming up, how do I get started? How is the existing validated assessment utilized for the interim review? Is there a fee for HITRUST to process the interim assessment? Do I have to perform my interim assessment in MyCSF? Will…

What evidence do you have that controls with high maturity will not change or degrade?

Control Maturity and Continuous Monitoring and Assessment FAQ » What evidence do you have that controls with high maturity will not change or degrade?

HITRUST’s analysis of organizational assessment data over the past 10 years indicates that the more mature an organization’s information protection program, specifically their information security controls which demonstrate proficiency of operation, management, and…

Will the number of requirements change from 1.0 to 2.0?

MyCSF FAQ » Will the number of requirements change from 1.0 to 2.0?

No. The number of controls required for CSF Certification is a function of the version of the CSF you are assessing against and not the version of MyCSF you are using.

Is inheritance all or nothing for each requirement or can it be weighted?

MyCSF FAQ » Is inheritance all or nothing for each requirement or can it be weighted?

You will be able to assign a weight to the inherited score that will apply to a particular control requirement.

My interim assessment is coming up, how do I get started?

Interim Review FAQ » My interim assessment is coming up, how do I get started?

MyCSF subscribers will automatically receive an interim assessment notice 90 days prior to the required submission date. Customers may begin the process 120 days before the submission date by manually generating the object. Non-subscribers will automatically receive…

Does the 90-day rule for evidence apply for interim assessments

Interim Review FAQ » Does the 90-day rule for evidence apply for interim assessments

Yes, for control requirements that are not associated with required CAPs, they must have been in place for 90 days in order to be scored and they must have been tested within in the preceding 90 days from submission to HITRUST. This should not be an issue as the…

Who do I contact to better understand HITRUST’s certification for the NIST Cybersecurity Framework?

HITRUST CSF and NIST CSF Frequently Asked Question » Who do I contact to better understand HITRUST’s certification for the NIST Cybersecurity Framework?

Contact HITRUST by email at sales@hitrustalliance.net or by phone at 1.855.448.7878.

Can the tool link to supporting documents rather than copy?

MyCSF FAQ » Can the tool link to supporting documents rather than copy?

Yes. MyCSF 2.0 maintains a library of documentation and relationships between the documentation and its related control requirements and maturity domains.

How will the interim assessment process be different from the interim review memorandum previously used?

Interim Review FAQ » How will the interim assessment process be different from the interim review memorandum previously used?

The interim assessment now requires full testing of the sampled control requirements and must undergo the same Quality Assurance process as a full assessment.

Will we have the option to convert before subscription renewal?

MyCSF FAQ » Will we have the option to convert before subscription renewal?

Yes. If you are interested in migrating early, contact support@hitrustalliance.net and they will get you into the queue for migration.

If we decide to use the API, how will MyCSF development environments (QA/UAT) be available?

MyCSF FAQ » If we decide to use the API, how will MyCSF development environments (QA/UAT) be available?

Initial deployment of the API will focus on getting information out of MyCSF and into your native toolsets. The API will eventually allow getting information into MyCSF. Customers who subscribe at a level that includes this feature will be provided a test instance for…

Do non-contextual impact ratings for controls provide any real value?

Frequently Asked Questions About the HITRUST Risk Management Framework » HITRUST and the NIST Cybersecurity Framework FAQ » Do non-contextual impact ratings for controls provide any real value?

The term “non-contextual” is used to indicate that the rating does not consider the state of existing controls in a particular organization’s environment. The problem HITRUST is addressing with the non-contextual ratings is that many, if not most, organizations…

Will it be the same level of access as we get for full assessment submission?

Interim Review FAQ » Will it be the same level of access as we get for full assessment submission?

Non-subscriber’s access will be the same as the “report only” option, currently set at 1 object and 3 users.

How can I confirm an organizations certification status?

CSF Assurance Program FAQ » How can I confirm an organizations certification status?

To confirm an organizations certification status, please complete and submit the Certification Status Request form. HITRUST will validate the request release information with the approval of the certified organization.

How do we know which requirements will be sampled, and can we get advance notice of which ones will be included?

Interim Review FAQ » How do we know which requirements will be sampled, and can we get advance notice of which ones will be included?

Since the controls are selected randomly by MyCSF, there is not a way to provide an advance notice. However, for MyCSF subscribers, interim assessments can be generated up to 120 days in advance of their due date.