Cyberattacks continue to increase in frequency and scale, placing significant pressures on organizations to protect sensitive data and information. Many health care and other organizations even require vendors and contractors to have HITRUST CSF® certification from an external assessor to be eligible for, or start, engagements.

Navigating the complex components of certification, however, can drain significant time and resources that could cause your organization to lose contracts should you not be able to verify security protocols.

Assess your current cybersecurity standing, bridge potential gaps, and demonstrate your organization as a current, trustworthy protector of private data with a HITRUST CSF certification from our professionals.

How HITRUST CSF Can Support Your Organization

Though HITRUST CSF began as the set of security controls to support the federal laws protecting sensitive patient information in health care, it has now become data agnostic and focuses on any sensitive information that an organization needs to protect. The HITRUST CSF is a certifiable risk management framework for a range of organizations to demonstrate their security and compliance including:

• Technology companies handling large amounts of sensitive data
• Insurance companies with personally identifiable information (PII)
• Health care organizations looking to manage information security risk and compliance
• Any organization handling sensitive data, such as protected health information (PHI), proprietary information or PII

Based on strategic cybersecurity practices from the International Organization for Standardization (ISO) and the National Institute of Standards and Technology (NIST) Special Publication 800-53, HITRUST CSF can be leveraged to map out and comply with requirements and control areas of other security frameworks and standards.

A one-time assessment can also help report on information risk and compliance with:

• HIPAA, CMS, Joint Commission, Minimal Acceptable Risk Standards for Exchanges (MARS-E), and Health Industry Cybersecurity Practices (HICP)
• State-specific and international regulations
• Payment card industry data security standards (PCI DSS)
• General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other privacy regulations

Navigate the HITRUST Process

Whether your organization needs a new cybersecurity assessor or is planning its first assessment, our professionals can help guide you throughout the certification process.

Determining which of HITRUST’s three assessment types to verify your standing against is the first step.

How the HITRUST Assessment Process Works

We preface any of the above validated assessments—e1, i1, or r2—with a readiness assessment to prepare your organization for reporting and certification.

Interim assessments are available for the i1 and r2 assessments as the organization approaches the one-year anniversary of certification.

A bridge assessment, when applicable, can be used for previous r2 assessments.

Expansive HITRUST CSF and Cybersecurity Experience

With dedicated cybersecurity service lines, our professionals have extensive knowledge of cyber-risk frameworks. Our collaborative approach takes the time to understand the specifics of your organization’s needs and strategically develop unique solutions contextualized among greater industry trends and activity.

We don’t simply provide templates. We determine appropriate cybersecurity solutions, proactively, to help build foundations for long-term success—so you’re prepared to stay ahead of change and address new risks and challenges.

Our professionals understand the nuanced operations of organizations that handle secured information and the demands they require of their vendors—not only in health care, but for any industry or organization seeking to keep sensitive information safe.

Our one-firm approach allows your organization to tap into the full resources of our firm, integrating guidance and solutions related to other integral support areas.