Policy/Program Change Details
HITRUST will continue to accept, and process validated assessments under CSF v7 until December 31, 2016, which is six (6) months after the release of CSF v8. It should be noted that once a new version of the CSF is released, any new assessments or changes to existing assessments will cause the assessment to update to the current/latest version of the CSF.
Rationale
HITRUST recognizes any increase in requirements, even one as small as 10% in the HITRUST CSF v8 release, may not have been considered when preparing for a CSF validated assessment. This grace period allows organizations that purchased assessments based on the CSF v7 controls or that may have already begun their assessments with CSF v7 to complete them.
Timetable for Implementation
Effective Date: July 1, 2016
Enforcement Date: December 31, 2016