HITRUST CSF

Health Information Trust Alliance: asset management, vendor management, software integrity.


Short name	HITRUST
Region	Americas
Country or scope	United States
Sector	Healthcare
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers HITRUST

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 17 controls from Safeguard's control catalog for HITRUST.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 27: 5 written for HITRUST and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`HITRUST-07A` Inventory of Assets	All assets, including software components, must be identified and an inventory drawn up and maintained (HITRUST CSF control 07.a Inventory of Assets)	Scan
`HITRUST-10H` Control of Operational Software	Installation and versions of operational software must be controlled so the organization knows exactly which software releases are running (HITRUST CSF control 10.h Control of Operational Software)	Scan
`HITRUST-10M` Technical Vulnerability Management	Technical vulnerabilities must be identified in a timely fashion, which requires components to be identifiable against vulnerability databases (HITRUST CSF control 10.m Control of Technical Vulnerabilities)	Scan
`HITRUST-09J` Integrity Against Malicious Code	Detection and prevention controls against malicious code require the ability to verify the integrity of deployed software components (HITRUST CSF control 09.j Controls Against Malicious Code)	Scan
`HITRUST-05I` Third-Party and Vendor Risk	Risks from external parties supplying software must be identified, which requires knowing the supplier of each component (HITRUST CSF control 05.i Identification of Risks Related to External Parties)	Scan
`HITRUST-06-IPR` Intellectual Property Compliance	Use of software must comply with legal and contractual restrictions on intellectual property, requiring license information for components (HITRUST CSF category 06 Compliance, IPR control)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`01.a`	Access Control Policy
`01.b`	User Registration and De-Registration
`01.c`	Privilege Management
`01.d`	User Password Management
`02.a`	Information Classification
`03.a`	Risk Management Program
`04.a`	Security Policy Document
`05.a`	Management Commitment to Information Security
`06.a`	Identification of Applicable Legislation
`07.a`	Asset Inventory
`09.aa`	Audit Logging
`09.ab`	Monitoring System Use
`09.i`	Electronic Commerce Security
`10.a`	Security Requirements of Information Systems
`11.a`	Reporting Information Security Events
`12.a`	Business Continuity Management
`13.a`	Third-Party Service Agreements

Policy templates

Written for HITRUST:

HITRUST Information Security Management Policy
HITRUST Access Control and Privilege Management Policy
HITRUST Asset Management Policy
HITRUST Third-Party and Vendor Security Policy
HITRUST Security Incident Management Policy

And 22 from the standard set, adapted to HITRUST.