In MyCSF, organizational performance dashboards are available under theAnalytics tab. This section provides interactive reporting features, including trend charts, compliance scores, domain comparisons, CAP summaries, and benchmarking across multiple assessment objects. Unlike theReference LibraryorAdministration tab, which are used for framework access and account management, the Analytics tab focuses onreporting and visualization. It allows management and assessors to monitor both single-assessment results and enterprise-wide metrics. Importantly, dashboards are not restricted to certified reports; they are a built-in feature of MyCSF, accessible during preparation, readiness, and validated assessments. This makes the Analytics tab essential for organizations using HITRUST as an ongoing governance and risk management tool.

The HITRUST CSF is designed to protectall forms of sensitive information, not just structured digital data. This includeswords(text documents, records),numbers(financial data, identifiers),pictures(images, radiology scans, photographs), andsounds(voice recordings, call center data). The comprehensive scope ensures that entities consider every medium in which sensitive information may exist, whether electronic, physical, or spoken. This aligns with regulatory definitions, such as HIPAA, which recognizes both electronic and non-electronic forms of protected health information. By covering all forms, HITRUST ensures organizations apply consistent safeguards across their environments and do not overlook exposures outside IT systems, such as printed reports or recorded conversations.

The scoring model in HITRUST is hierarchical. EachRequirement Statementis scored individually across maturity levels (Policy, Procedure, Implemented, Measured, Managed). These scores roll up intoControl References, which represent collections of related requirement statements. The average of Control References within a domain determines theDomain Score. Finally, domain scores are used to evaluate whether certification thresholds are met (e.g., minimum domain score of 71 for r2 certification). This hierarchical averaging ensures that deficiencies in individual requirements are reflected in higher-level scores, promoting balance across all controls within a domain.

HITRUST CSF’srisk-based levelswere adapted fromNIST SP 800-53, which organizes controls into baseline categories based on impact levels:low, moderate, and high. Similarly, HITRUST assigns requirement statements across multiple implementation levels (Level 1, Level 2, and Level 3) depending on organizational, technical, and regulatory risk factors. This approach ensures scalability, so smaller organizations or lower-risk environments face fewer requirements, while larger, high-risk entities face more. HITRUST harmonized this concept with mappings to other frameworks (ISO, HIPAA, PCI-DSS), but the structure of escalating control rigor by risk exposure is directly derived from NIST’s model. This alignment reinforces HITRUST’s credibility as a risk-based framework consistent with widely accepted standards.

HITRUST requires that all newr2 assessmentsuse thelatest available versionof the CSF framework. This ensures that assessments reflect the most current regulatory mappings, authoritative source updates, and industry security practices. For example, if HITRUST releases CSF version 11.x, new assessments initiated after its release must adopt that version. Organizations with ongoing assessments may complete them on the prior version but must transition to the latest version for new engagements. This policy ensures consistency and prevents outdated control sets from being used in certification, which could weaken reliance by stakeholders. Keeping assessments aligned with the current version also reflects HITRUST’s commitment to maintaining the CSF as a “living framework.”

In HITRUST assessments, certain maturity level scores may bepre-populatedin MyCSF based on scoping factors, inheritance, or framework defaults. However, these default entries arenot lockedand can be changed by the assessed entity or assessor if evidence supports a different result. For example, if a requirement defaults to “Non-Compliant (0),” but the organization provides documentation showing a control is fully in place, the score may be updated to reflect “Fully Compliant (100).” Similarly, inherited scores from a service provider can be overridden if the organization chooses not to rely on inheritance. HITRUST’s design encourages entities to evaluate each control in their environment rather than accepting defaults blindly. QA will review all adjusted scores against supporting evidence to confirm accuracy.

The A1 Security Assessment factor is an optional module that introduces requirements for evaluating the security and governance of AI-based systems. These requirements are mapped into HITRUST CSF across domains like risk management, monitoring, and governance. Importantly, the A1 factor is not restricted solely to r2 assessments. While r2 provides the most comprehensive assurance model, A1 can also be added to other eligible assessment types such as i1 when the scope involves AI risks. The factor is treated like any other regulatory or organizational factor in MyCSF—its selection generates additional tailored requirement statements. Therefore, the claim that A1 canonlybe added to r2 is inaccurate. The correct understanding is that A1 can apply tomultiple assessment types, depending on scoping decisions.