MyCSF FAQs
Does MyCSF 2.0 give organizations access to their vendors and their HITRUST certifications (or lack thereof)?
No. This functionality is part of the HITRUST Assessment XChange. For more information on the XChange, contact getinfo@hitrustax.com.
Can the tool link to supporting documents rather than copy?
Yes. MyCSF 2.0 maintains a library of documentation and relationships between the documentation and its related control requirements and maturity domains.
Is attaching a w/p or policy required? I thought only the name of the evidence we collected was needed in the tool. After that, if QA’d by HITRUST, is the evidence needed?
There are several changes that will be announced relating to the Assurance Program requirements. These are independent of the HITRUST CSF and MyCSF and are designed to increase the consistency and integrity of the assurance process.
The other types of assessments (GDPR, etc.) are only self-assessments and can’t be validated?
Yes. We do not generate any type of assurance report for targeted assessments. There are assessments that you can perform internally, and you can generate score cards within the tool.
Will HITRUST provide a webinar specifically for assessors and practitioners? How do practitioners see customer comments, the evidence cited and how will assessors and practitioners provide comments?
Yes. We will be revising the full and refresher training courses. These can be taken through our LMS and will walk assessors through the process. We intend to make this module available to all CCSFPs.
Is there a limit to the number of active assessments?
Yes. The number of assessments that an organization can have is limited by the level of access they have in MyCSF. Subscribing customers can purchase additional assessment objects in MyCSF if necessary.
Can other types of assessments be done such as FISMA?
Yes. In the HITRUST r2, targeted assessments can be performed against any of the authoritative sources of the HITRUST CSF. Targeted assessments are not submitted to HITRUST for validation and will not result in a HITRUST assurance report. They will only generate the appropriate scorecard within MyCSF.
If we use the API, is there a development environment available?
Deployment of the API focuses on getting information out of MyCSF and into your native toolsets. The API also allows getting information into MYCSF. Customers who subscribe at a level that includes this feature will be provided a test instance for integration testing.
Can you export assessments into a spreadsheet or csv document?
Organizations that have the appropriate subscription are able to export assessment data. Assessors’ test objects do not have this capability.
Can I get a HIPAA specific report?
Yes. In MyCSF 2.0 there is the ability to generate a targeted assessment against any one of the authoritative sources. Targeted assessments will only generate scorecards within MyCSF and will not result in a HITRUST Assurance Report.
How do I use the Reservation System to schedule submission of a HITRUST Validated Assessment?
Within MyCSF, go to the Reservation Tab in the toolbar. Click the link and follow the step-by-step procedure. All HITRUST e1, i1 and r2 Validated Assessment submissions into the QA process must be scheduled.
Do you support a hierarchy so that you can respond once on common controls like HR related items with the parent company and the responses go to all the sub assessments?
No. We do not have a hierarchy nor maintain any relationships between assessments. We encourage organizations to take advantage of the inheritance capability to achieve this.
APIs – which GRC tools will the APIs connect to? Will it allow the import of controls into the GRC tool and export from GRC response fulfillment into MyCSF 2.0?
The API allows use by many GRC tools. We are working with the largest players in the GRC market to develop guidance for the integration process. The current API deployment will allow for information to be extracted from MyCSF. In the future, you will be able to place information from your native tool sets into MyCSF. We will be publishing the API specification in the near future.
Will you be able to produce the targeted assessment, i.e., PCI from the HITRUST assessment, for the questions that are the same?
No. A targeted assessment will be generated from the CSF library by pulling all requirements related to the targeted authoritative source. It will be a stand-alone assessment, but it can inherit from other assessments with the appropriate subscription level.
Does evidence always have to be referenced to the requirement for each assessed area (e.g., implementation, measured, managed) or can we say that we observed and explained what is being done?
When possible, all evidence should be uploaded into MyCSF. This ensures a quick and consistent QA process. Failure to upload all evidence of testing will result in a “live” QA review by HITRUST via Webex.
Is there a fee associated with API integration? Or a subscription level?
Yes. This feature is only available with certain subscription levels.
Are there any performance improvements with MyCSF 2.0?
Yes. We have minimized the number of clicks required to navigate an assessment. Also, we have tuned all queries and optimized caching to improve overall performance.
Does the tool support organizations other than those in healthcare?
Yes. MyCSF and the HITRUST CSF support organizations across all industries and globally.
Does a subscription add value if I am not getting HITRUST Certified?
Yes, even if you are only completing an assessment. Purchasing a subscription will open access to the MyCSF assessment, authoritative source reporting and will include a full, customizable view of the HITRUST CSF, advanced analytics for managing risk posture, benchmarking data, ability to leverage the functionality to support Corrective Action Plan (CAPs) management and longer-term remediation tracking. A subscription also includes the interim assessment at no additional cost.
What are the advantages of having a subscription to MyCSF?
- To save time and costs :
- A subscription enables clients to retain data, eliminating redundant (internal or assessor) data-entry tasks for the interim assessment and subsequent assessments saving organizations potentially hundreds of hours on a two-year assessment cycle.
- With Advanced Analytics & Benchmarking in the MyCSF tool, reporting and analytics for managing the assessment will help reduce cycle time and resources required by providing actionable reports.
- The interim assessment is included for no additional cost. A savings of $3000.
- Better understanding of risks :
- A subscription provides an organization continuous visibility to risk posture throughout the assessment lifecycle and provides insight into their overall risk status. It allows organizations to continuously assess over time, reacting to changes to the HITRUST CSF and threats in its environment, and to maintain a constant and clear understanding of risk posture.
- Improves management reporting :
- With Advanced Analytics & Benchmarking, organizations have the ability to communicate what has been done, is being done and needs to be done in the assessment process. Management and administrator reporting that enables organizations to maintain alignment across all levels of management and Board of Directors for accurate decision making.
What do I receive if I only purchase a report?
Those purchasing a report and not a subscription to MyCSF will only have access to the MyCSF Assessment and Reports for authoritative sources such as HIPAA, SOC2, and HITRUST. Also, report-only access is limited to 90 days. Extensions of access may be purchased for an additional fee. Each extension is for 30 days of access—a maximum of one extension is allowed.
Can I get a trial subscription or demo?
HITRUST does offer a free 2-week trial access in the MyCSF tool. This access is provided in a sandbox environment. This environment does not contain all of the functionality found in the production version of MyCSF and information input into this system will not transfer into production should you subscribe. It is designed for organizations to familiarize themselves with MyCSF. Request a trial here. Organizations can also request a demonstration through our website.
Why should I purchase a MyCSF subscription if I just need a report?
Purchasing a subscription will open access to the MyCSF assessment, authoritative source reporting and will include a full, customizable view of the HITRUST CSF, advanced analytics for managing risk posture, benchmarking data, ability to leverage the functionality to support Corrective Action Plan (CAPs) management and longer-term remediation tracking. A subscription also includes the r2 Interim Assessment for no additional cost.