HITRUST CSF v11.5.0 — HITRUST Common Security Framework

Why does it matter?

HITRUST built the CSF so that one control set, mapped to many authoritative sources, supports one assessment that an organization can share with many parties. The Assurance Program gives organizations a common mechanism for communicating validated controls to business partners without redundant, overlapping and costly audits (Introduction, HITRUST Assurance Program).

Key benefits include:

• One control set, many sources

The CSF normalizes requirements from federal law such as HIPAA, federal agency guidance such as NIST, state law, international regulation such as the GDPR and industry frameworks such as PCI into one framework.

• Requirements scale to risk

Organizational, compliance and system risk factors decide which of three progressive implementation levels apply, so the requirement set fits the organization instead of being the same for everyone.

• Three assurance levels

e1 is a foundational 1-year assessment, i1 is a 1-year assessment with 182 requirement statements and r2 is a 2-year risk-based assessment. Work done for a lower level can be built upon for a higher one.

• A published version policy

Versions follow v[Major].[Minor].[Errata]. A minor release such as v11.5.0 changes requirement statements, authoritative sources, mappings or factors and is announced in an Assurance Advisory (HAA 2021-005).

• Segment-specific requirements

Additional implementation levels cover specific segments, such as cloud service providers, FedRAMP and EU GDPR, where those requirements apply.

How does it work?

The CSF has 14 control categories, 49 control objectives and 156 control specifications. The categories run from Information Security Management Program, Access Control and Risk Management to Communications and Operations Management, Information Security Incident Management, Business Continuity Management and Privacy Practices. Each control lists an objective, a reference, a specification, a risk factor type, topics, implementation requirements and a mapping to authoritative sources by level.

Implementation requirements come in three levels. Level 1 is the minimum baseline and each higher level adds requirements. The level that applies depends on organizational factors, such as the amount of sensitive information and geographic scope, compliance factors, such as PCI, FISMA or the GDPR, and system factors, such as Internet accessibility, third-party access and the number of users.

An organization scopes its systems in MyCSF, tailors the requirements and completes an e1, i1 or r2 assessment. The Assurance Program uses maturity-level scoring and risk ratings, and recognizes internal assessors and HITRUST Authorized External Assessor Organizations. HITRUST governs and manages the assurance process. Results can be distributed to partners through the Results Distribution System.

Key Elements

• Control categories and specifications

Fourteen categories hold 49 control objectives and 156 control specifications, built on the ISO/IEC 27001 and 27002 categories plus separate categories for the information security management program and risk management.

• Authoritative sources

Each requirement is mapped to the standard or regulation it comes from. More than 60 sources sit on top of the ISO/IEC 27001 and 27002 core, including HIPAA, NIST SP 800-53, the GDPR, PCI and COBIT.

• Risk factors and implementation levels

Organizational, compliance and system risk factors raise the level of requirement that applies. Segment-specific levels add requirements for areas such as cloud service providers.

• Assessment types

e1, i1 and r2 are the validated assessments. e1 and i1 are valid for 1 year, and r2 is valid for 2 years. r2 is the tailored assessment for organizations that must show compliance with sources such as HIPAA.

• MyCSF and the Results Distribution System

MyCSF is the software platform for assessments and corrective action plan management. The Results Distribution System is the API that distributes assessment results.

• What v11.5.0 changed

Released 14 April 2025, v11.5.0 consolidated more overlapping requirement statements, added nine mappings including ADHICS, Singapore's Cybersecurity Act 2018 and the NIS Directive, mapped COBIT 2019, and left the baseline r2 requirement statements unchanged from v11.4.0 (HAA 2025-001).

What does it cover?

The CSF applies to organizations in any sector that create, access, store or transmit sensitive information, and it is most associated with healthcare organizations, their business associates and cloud providers. Scope is set for each assessment by choosing the systems in scope and the risk factors that apply to them. A HITRUST assessment covers the scoped environment, not the whole organization.

What are its objectives?

The Introduction states what the CSF is meant to do.

Provide one common security and privacy framework, mapped to global authoritative sources.

Scale security and privacy requirements to organizational, compliance and system risk.

Offer certifiable, validated assurance through the e1, i1 and r2 assessments.

Reduce redundant requirements with each release by integrating and normalizing sources.

Let organizations share results with partners instead of repeating separate audits.

Framework in Context

The CSF is a private framework, not a regulation, and it is revised several times a year. v11.5.0 sits between v11.4.0 (6 December 2024) and v11.6.0 (22 August 2025). Later releases keep changing the authoritative sources: v11.9.0 refreshed the NIST SP 800-53 mapping to Rev. 5.2.0 and removed several sources, including NIST SP 800-53 r4 (HAA 2026-005). Check the HITRUST Framework page for the release that applies to a new assessment.

Common Framework Mappings

HITRUST maps each CSF requirement to authoritative sources, and HIPAA, ISO/IEC 27001 and 27002 and NIST SP 800-53 are among them. The list below also names frameworks that organizations commonly map alongside the CSF, and not every one is an authoritative source of it.

Mapped frameworks include:

CIS Controls v8.1

HIPAA

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2