Higher Quality and Reliability at Every Level of Assurance
(New Assessments Available at the End of 2021)
HITRUST CSF Certification is the most reliable information assurance report on the market and made possible by the transparency and consistency in the selection of controls, and in the scoring, and validation of controls by both qualified third-party assessors and the HITRUST Assurance and Quality teams. The Assurance process is rigorous by design to ensure a high level of assurance in the results provided. However, there are many situations where a moderate or low level of assurance is warranted, and organizations are seeking a broader range of assessment options that require less effort and time to perform while still providing a commensurate level of reliability for moderate- to lower-risk scenarios.
To meet the market needs for varying levels of assurance with higher reliability, HITRUST is adding two new assessment offerings. Like the HITRUST CSF Validated Assessment, these new offerings will aid in understanding control effectiveness as well as cyber preparedness and resilience. With the two new additions, the HITRUST assessment portfolio will include:
- The Basic Current State (bC) Assessment is a “good hygiene” assessment and offers higher reliability than self-assessments and questionnaires by utilizing the HITRUST Assurance Intelligence Engine™ (AI Engine) to identify errors, omissions, and deceit.
- The Implemented 1-Year (i1) Assessment is a “best practices” assessment and recommended for situations that present moderate risk or where a baseline risk assessment is needed. The i1 is designed to provide higher levels of transparency, integrity, and reliability over existing moderate assurance reports, with comparable levels of time, effort, and cost. HITRUST Authorized External Assessors will validate i1 assessments.
- The industry standard HITRUST CSF Validated Assessment is a risk-based and tailorable assessment, which continues to provide the highest level of assurance for situations with greater risk exposure due to data volumes, regulatory compliance, or other risk factors. The HITRUST CSF Validated Assessment will be renamed the HITRUST Risk-Based, 2-Year (r2) Assessment.
To learn more, join our upcoming webinar on November 9, 2021.
PREVIEW: Expanded HITRUST Assessment Portfolio
(Release Planned by End of 2021)
Current State Assessment (bC)
1-year (i1) Assessment
2-year (r2) Assessment
(Former Name: HITRUST CSF Validated Assessment)
|Description||Verified Self-Assessment||Validated Assessment + Certification||Validated Assessment +
|Purpose (Use Case)||Focus on good security hygiene controls in virtually any size organization with a simple approach to evaluation, which is suitable for rapid and/or low assurance requirements||Focus on leading security practices in medium-sized and larger organizations with a more rigorous approach to evaluation, which is suitable for moderate assurance requirements||Focus on a comprehensive risk-based specification of controls suitable for most organizations with a very rigorous approach to evaluation, which is suitable for high assurance requirements|
|Number of Control Requirement Statements||71 Static||Approximately 200 Static||2000+ based on Tailoring
(360 average in scope of assessments)
|Specificity of Control||Granular Requirements||Granular Requirements||Granular Requirements|
|Flexibility of Control Selection||No Tailoring||No Tailoring||Tailoring|
|Evaluation Approach||1×3: Control Implementation||1×5: Control Implementation||3×5 or 5×5: Control Maturity assessment against either 3 or 5 maturity levels|
|Targeted Coverage*||NISTIR 7621: Small Business Information Security Fundamentals||NIST SP 800-171, HIPAA Security Rule||NIST SP 800-53, HIPAA, FedRAMP, NIST CSF, AICPA TSC, PCI DSS, GDPR, and 37 others|
|Level of Assurance**||Low||Moderate||High|
|Relative Level of Effort||0.5||1.0||5.0|
|Certifiable Assessment||No||Yes, 1 Year||Yes, 2 Year|
|Complementary Assessments||None||Readiness||Readiness, Interim, Bridge|
|Leverages Results Distribution System (RDS) to Share Results||Yes||Yes||Yes|
|Leverages the AI Engine to Prevent Omissions, Errors, or Deceit||Yes||Yes||Yes|
*Targeted Coverage means substantial coverage is intended
** A particular level of assurance (e.g., low, medium/moderate, or high) is generally characterized by the relative level of suitability, impartiality, and rigor in the approach used to specify, assess, and report on the effectiveness of information security and privacy controls and the risks they are intended to manage.
Additional HITRUST Assessment Options:
HITRUST Readiness Assessment. A self-attested assessment that is often used to determine security posture and any potential remediation efforts in preparation for a future HITRUST Assessment. Available for use with the HITRUST Implemented 1-Year (i1) Assessment and the HITRUST Risk-Based, 2-Year (r2) Assessment.
HITRUST Interim Assessment. Organizations with a HITRUST Risk-Based, 2-Year (r2) Certification will need to perform a HITRUST Interim Assessment at the one-year mark to keep their certification valid.
HITRUST Bridge Assessment. Allows organizations to earn a bridge certificate to maintain their HITRUST Risk-Based, 2-Year (r2) Certification for an additional 90 days, even if their assessment submission due date is missed.
New Results Distribution System (RDS): Available for All HITRUST Assessments
(Initial Release Planned by End of 2021)
The HITRUST RDS addresses the highly inefficient process of obtaining, interpreting, and analyzing assessment results from third-party vendors. Today, third-party attested security and privacy assessment reports are delivered to the assessed entity in PDF format. In many cases, the assessed entity is asked to share their assessment report with a relying party (e.g., customer, trading partner, or regulator) who then must manually review the report to identify the salient information they need to make better-informed decisions about the risk an assessed entity presents to their organization. The RDS allows for assessed entities to share assessment results through a secure web portal or API so that relying parties can more easily find and leverage the information they need to make better-informed decisions quicker.