Overview
HITRUST is decommissioning CSF v9.5 and v9.6 according to the timeline below.
Notice and Timeline Details
Support of CSF v9.5 through v9.6
Effective as of the release of this advisory, maintenance support (i.e. CSF updates that would result in an errata release according to HAA 2021-005: CSF Versioning Policy) of v9.5 and v9.6 will be discontinued. Questions related to these library versions will continue to be addressed via support tickets until the libraries are removed from MyCSF on July 31, 2026. All assessments using v9.5 – v9.6 will remain in MyCSF.
Key Assessment Dates
- Effective June 30, 2024, the ability to create new v9.5.0 through v9.6.2 assessment objects will be disabled. All new assessment objects created on or after June 30, 2024, must be created using HITRUST CSF v11 or later.
- Effective April 30, 2025, the ability to submit v9.5.0 through v9.6.2 assessment objects to HITRUST for report processing will be disabled.
- Effective as of the release of this advisory, the QA Reservation system will not allow the selection of a submission date after April 30, 2025, when booking a reservation for an assessment object using v9.5.0 through v9.6.2.
Note that the following will not be impacted by the above notice:
- Interim and Bridge Assessments will continue to utilize the same version of the HITRUST CSF that was used to create the original r2 Validated Assessment.
- Internal and external inheritance will continue to be available from v9.5.0 through v9.6.2 assessment objects until their expiration—for Uncertified r2 Validated Assessments, a period of one (1) year from report date, and for Certified r2 Validated Assessments, a period of two (2) years from report date and timely completion of its Interim Assessment.
Additional resources
For any additional questions, please contact our Support team or a HITRUST Customer Success Manager.