HITRUST CSF — Interview Notes

Overview
Portal myCSF — HITRUST's compliance management portal for assessments and certification tracking
3 Parties HITRUST (Body/Authority) External Assessor Your Organization
Applicable Frameworks ISO 27001 NIST CSF PCI DSS HIPAA GDPR
Control Lifecycle Policies → Procedures → Implemented → Measured → Managed
CSF Structure
Domains 19 control domains
Controls 300–800 requirements (varies by assessment type and scope)
19 Control Domains
Group Domains Examples & How to Implement
Governance & Risk
  • Information Protection Program
  • Risk Management
  • Audit Logging & Monitoring
Info Protection — Written IS policy + annual review cycle
Risk Mgmt — Risk register with likelihood/impact scoring; quarterly reviews
→ Use NIST RMF or ISO 27005 as risk methodology backbone
Audit Logging — Centralized SIEM (e.g., Splunk, CloudWatch) with 90-day retention
→ Enable CloudTrail + Config; alert on admin actions via EventBridge/SNS
Access & Identity
  • Access Control
  • Password Management
Access Control — RBAC + least-privilege; quarterly access reviews
→ AWS IAM roles, Okta groups, or Azure AD; no standing admin access
Password Mgmt — MFA enforced; min 12-char passwords; no shared accounts
→ SSO via SAML/OIDC; use a password manager (1Password, Bitwarden)
Infrastructure
  • Endpoint Protection
  • Network Protection
  • Configuration Management
  • Vulnerability Management
Endpoint — EDR on all devices (CrowdStrike/Defender); MDM enrollment
Network — VPC segmentation, WAF, no open 0.0.0.0/0 rules
→ Security Groups as allow-list; NACLs as backstop; VPN for remote access
Config Mgmt — IaC (Terraform) + drift detection via AWS Config Rules
→ Enforce CIS Benchmarks; use OPA/Sentinel for policy-as-code gates
Vuln Mgmt — Monthly scans (Tenable/Inspector); critical patches within 30 days
Data & Privacy
  • Data Protection & Privacy
  • Physical & Environmental Security
Data Protection — Encrypt at rest (AES-256) and in transit (TLS 1.2+)
→ S3 SSE-KMS + bucket policies; RDS encryption enabled at creation
Privacy — Data inventory/classification; PHI/PII handling procedures; DPA agreements
Physical — Badge access logs; camera coverage; AWS handles data center controls (SOC 2 inheritance)
Operations
  • Incident Management
  • Business Continuity (BCP)
  • Supplier / Third-Party Mgmt
Incident Mgmt — Documented IR plan; defined severity levels; tabletop exercises annually
→ PagerDuty/OpsGenie for alerting; post-mortems within 5 days of incident
BCP — RTO/RPO defined per system; backup tested quarterly; failover runbooks
→ Multi-AZ deployments; S3 cross-region replication for critical data
Supplier Mgmt — Vendor risk assessments; BAAs for PHI vendors; annual re-review
Certification Process
1Gap Assessment — Identify control gaps against selected CSF baseline
2Remediation — Address gaps; implement or document required controls
3Validation — External assessor reviews evidence and scores controls
4Certificate Submission — HITRUST issues certification upon successful validation
Assessment Tiers (e-Score Levels)
Level Tier Requirements
e1 Basic / Entry-Level 44 requirements — essential hygiene controls; fastest path to certification
i1 Moderate 182 requirements — adds operational and process controls; suitable for most mid-market orgs
r2 High 400+ requirements — full risk-based assessment; required for regulated/high-sensitivity environments (e.g., HIPAA covered entities)