The 19 assessment domains HITRUST uses to organize requirement statements and score certification. Pages stay at domain level, since the CSF requirement text is proprietary.
Covers the organization's formal information security management program: governance, policies, roles and the program that the other 18 domains depend on. It is the domain most tied to management ownership rather than tooling.
Covers protection of laptops, workstations, servers and other devices that can reach the in-scope environment, including malware defenses and secure configuration. HITRUST reports it as the domain that most often causes failed certifications.
Covers control of removable and portable media such as USB drives, external storage and backup media, including handling, encryption and disposal. Much of it can be inherited where media stays inside a provider's data center.
Covers phones, tablets and other mobile devices used to reach systems or data in scope, including encryption, device management and conditional access.
Covers the organization's own wireless networks and remote access paths: configuration, authentication and monitoring of Wi-Fi in the assessed scope.
Covers secure baselines, change control and configuration of systems and services in scope. It carries several of the AI security requirements added by HITRUST's AI security certification.
Covers vulnerability scanning, patching and remediation of applications, libraries, containers and infrastructure in scope. HITRUST reports it as the lowest scoring i1 domain in 2024.
Covers perimeter and internal network security: segmentation, firewalls, network services and the security of network service providers.
Covers protection of data in transit: TLS on application endpoints, secure exchanges with third parties and certificate management.
Covers the use of traditional passwords and credentials: password policies, storage and the multi-factor authentication that backs them up. HITRUST reports it among the hardest domains to score well in.
Covers identity, authorization and account management: provisioning, least privilege, access reviews, lockout and privileged access. Three of HITRUST's ten most frequent corrective action plans in 2024 fell here.
Covers generation, protection, review and retention of audit logs and security monitoring of the in-scope environment, including who reviews logs and how often.
Covers security awareness and role-based training for staff, developers and administrators with access to the environment in scope.
Covers oversight of vendors and service providers: due diligence, contracts, service level reviews and monitoring of third parties that handle in-scope data. It held HITRUST's most frequent corrective action plan in 2024.
Covers incident response planning, reporting, handling and lessons learned for security events affecting the environment in scope.
Covers business continuity planning, backups, restore testing and resilience of the systems in scope.
Covers the organization's risk assessment and treatment process, including formal authorization of systems before use and periodic risk reviews.
Covers physical access to facilities, data centers and equipment and environmental protections such as power and HVAC for the facilities in scope.
Covers data classification, retention and deletion, encryption at rest and privacy obligations for in-scope data. It is the domain that carries privacy requirements when an r2 is tailored to include privacy.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.