This article was updated on October 27, 2023.

The HITRUST CSF is a certifiable security and privacy framework that helps organizations secure, comply, and assess against several security and privacy-related standards, regulations, and recommended practices.

HITRUST is used by organizations in many different highly regulated industries, such as health care organizations, technology companies, insurance plan providers, and any organization that handles different classifications of sensitive data.

With its version 11 update, HITRUST has maintained its commitment to improve the framework. The latest version helps organizations better manage risk by staying updated on the current cyberthreat landscape.

HITRUST CSF Version 11

HITRUST launched version 11 of the CSF at the beginning of 2023.

HITRUST is decommissioning the version 9.x series. Organizations currently using version 9.1 through 9.4 must switch over to version 11 or a higher version of 9.x—either 9.5 or 9.6—by 2024.

Timing and Deadlines

Organizations have until December 31, 2024, to submit assessments using versions 9.1 through 9.4, but any new assessment objects using these versions had to be created by September 30, 2023.

Organizations currently using versions 9.5 or 9.6 for r2 assessments can continue to use those versions, but they will also be decommissioned in the future.

Three HITRUST Certification Assessment Types

The following is a cursory explanation of each assessment type. For more details on each assessment, visit HITRUST Assurance Advisories.

Is There a Risk to Using 9.5 or 9.6 Instead of Moving to HITRUST CSF Version 11?

While all active HITRUST frameworks provide a high level of assurance, Version 11 is based on the latest ongoing cybersecurity threats and improved control mappings. If you already assess against version 9.5 or 9.6, the recommendation is to stay with that version and start to compare the changes made to version 11 so you can update policies, procedures, or implemented evidence to eventually move to the new version.

Could HITRUST Certification Be the Next Level of Your Security Program?

Some organizations have begun to utilize HITRUST assessments instead of SOC examinations to evaluate a vendor’s maturity of their security and privacy controls.

Unlike SOC examination, also known as SOC audits, organizations cannot define the controls with a HITRUST assessment. HITRUST requirements are more specific, maturity-based, and harder to meet.

We’re Here to Help

For guidance on implementing HITRUST version 11 or developing or improving a security program at your organization, contact your Moss Adams professional.

Additional Resources

• HITRUST Compliance Services
• IT Compliance