HITRUST assessment types
The HITRUST assessments and add-ons an organization can pursue on the CSF: the e1, i1 and r2 certifications, AI security and AI risk management, the NIST CSF 2.0 add-on and Insights Reports.
HITRUST CSF
HITRUST's proprietary, certifiable control framework that harmonizes dozens of standards and regulations, assessed through the e1, i1 and r2 validated assessments. Pages cover assessment types and the 19 assessment domains at domain level only.
HITRUST assessment domains
The 19 assessment domains HITRUST uses to organize requirement statements and score certification. Pages stay at domain level, since the CSF requirement text is proprietary.
HITRUST assessment preparation
Getting ready for a HITRUST validated assessment: readiness work, scoping, incubation periods, evidence and sampling rules, N/A decisions, alternate controls and r2 tailoring.
HITRUST scoring and corrective action plans
How HITRUST scores maturity, what it takes to pass each domain, why assessments fail and how corrective action plans and gaps work.
HITRUST inheritance and shared responsibility
Reusing results from cloud providers, vendors and your own earlier assessments: inheritance, shared responsibility matrices, carve-outs, reliance on SOC 2 and other reports, and becoming an inheritance provider.
HITRUST renewal and maintaining certification
Keeping a HITRUST certification valid: r2 interim assessments, rapid recertification, bridge certificates, significant changes, security incidents, CSF version updates and moving up to a higher assessment.
HITRUST reports and sharing results
What HITRUST reports contain, how to share them with customers, and how relying parties should read a vendor's HITRUST certification.
HITRUST consultants, assessors and tools
Who can do HITRUST work and what to buy: consultants and readiness licensees, assessor independence, what to outsource, CCSFP training, internal assessors, MyCSF subscriptions and open-source tools that evidence common domains.
HITRUST guides
Buyer questions organizations ask when a customer or contract requires HITRUST: which assessment level, what it costs, how the process runs, how it compares with SOC 2 and how to pick an assessor.
