HITRUST CSF

HITRUST CSF is a certifiable framework that harmonizes HIPAA, NIST, ISO 27001, and other regulations into a single assessment. The e1, i1, and r2 assessments represent increasing levels of rigor. Comm

HITRUST CSF is a certifiable framework that harmonizes HIPAA, NIST, ISO 27001, and other regulations into a single assessment. The e1, i1, and r2 assessments represent increasing levels of rigor. Common in healthcare, payer, and large health-tech ecosystems.

Key controls

• e1: 43 foundational controls; i1: 182 control requirements; r2: tailored to the organization's risk profile (no fixed count)
• r2 certification is valid for two years, with an interim assessment after year one