HITRUST, in collaboration with private sector, government, technology and information privacy and security leaders, has established the HITRUST CSF, a certifiable framework that can be used by any organization that creates, accesses, stores or exchanges sensitive information. The HITRUST CSF harmonizes multiple frameworks, standards, state, federal and International regulations and leading practices into a single framework. The HITRUST CSF addresses industry- specific challenges by leveraging and enhancing existing frameworks, standards and regulations to provide organizations of varying sizes, geographic operation and risk profiles with prescriptive implementation requirements and guidelines.

The HITRUST CSF is a scalable, prescriptive and certifiable framework that harmonizes numerous standards, regulations, control frameworks and leading practices

The CSF Assurance Program is the oversight and assessment methodology governed by HITRUST and designed to address regulatory and business needs

The MyCSF Risk Assessment Platform (SaaS) is a secure, web-based solution for assessing against the HITRUST CSF or any of its harmonized standards, regulations, control frameworks and authoritative sources to manage compliance and measure risk

The HITRUST Academy provides education to individuals about the HITRUST CSF Assurance and De-Identification processes

Organizations are challenged with efficiently and effectively evaluating the information privacy and security controls in place with their trading partners in a manner that is consistent with the risk posed by that relationship. By leveraging the HITRUST CSF Assurance Program’s integrity, transparency and consistency to enhance and streamline their third-party risk management processes, they can reduce costs associated with vetting, onboarding, and continuous monitoring of third-party risk.

HITRUST’s CSF assessment reports provide for a comprehensive, consistent and standardized approach customers can use to evaluate the information privacy and security controls effectiveness of their business partners, while enabling business partners to reduce their costs by having a single assessment, that can be leveraged by their various customers.

LEARN MORE

By leveraging HITRUST’s CSF assessment reports, organizations can have a comprehensive, consistent and standardized approach to communicating information privacy and security effectiveness to their customers. The HITRUST CSF Assurance Program is built upon the principles of integrity, transparency and consistency to ensure that report recipients can understand and rely on the findings, while the “assess once report many” approach allows one assessment to be used to satisfy numerous reporting requirements thus reducing costs and saving resources.

Key reports that can be issued from performing a HITRUST CSF assessment include a HITRUST CSF Assurance Report (Certification), NIST Cybersecurity Framework Scorecard and Certification, and a SOC2 + HITRUST CSF Assurance Report.