HITRUST CSF

HITRUST CSF is a certifiable security and privacy framework that consolidates requirements from more than 70 external standards and regulations — including HIPAA, NIST, ISO 27001, and PCI DSS — into one set of controls, assessed at three tiers: e1 (foundational, one-year), i1 (moderate assurance), and r2 (comprehensive, two-year certification). It's used mainly by US healthcare organizations, health plans, and their vendors handling protected health information, typically as a contractual requirement imposed by payers and large health systems. The current release is CSF v11.8.0 (May 2026).