Which HITRUST CSF® Version Should I Choose?

While the latest version of any product is often seen as the greatest, there is more nuance involved when trying to determine which version of the HITRUST CSF® framework to utilize for certification. Currently, users can choose from versions 9.1, 9.2, 9.3, and 9.4. With the impending release of HITRUST CSF v10p (preview) in mid-May 2021, and a full release of v10 scheduled for later in the year, it adds more questions about whether to make the jump to 10 right away, if you have to make the jump to 10, and when will you be required to make the jump to version 10; all of which we’ll tackle.

If you are going through a first-time HITRUST CSF Validated Assessment (and seeking certification) or undergoing your recertification in the near future, you have to keep the following in mind:

• To use versions 9.1, 9.2, and 9.3 for your validated assessment object, the object must be created by August 1, 2021 and you will have until December 31, 2022 to submit to HITRUST for review. If that date range suits your compliance needs, you will want to consider the difference in versions. (Note that versions are generally additive, e.g., GDPR added in v9.1 is still available in v9.2 and 9.3)
  • Version 9.1 incorporated both the EU General Data Protection Regulation (GDPR) and New York State Cybersecurity Requirements for Financial Services Companies (23 NYR 500).
  • Version 9.2 incorporated the Singapore Personal Data Protection Act (PDPA) and made significant revisions to the HITRUST CSF Control Category for Privacy Practices to support the placement of HIPAA-specific requirements in a separate segment in all categories, marking a shift to a more industry-agnostic approach for the HITRUST CSF and to better align with existing international privacy frameworks.
  • Version 9.3 added the California Consumer Privacy Act (CCPA), NIST SP 800-171 RS (DFARS), the South Carolina Insurance Data Security Act (SCIDSA), and made updates to various authoritative sources to the latest versions which included, amongst others, the NIST Cybersecurity Framework v1.1. This update also adjusted select risk and regulatory factors to ensure that only controls appropriate to a given assessment are included, streamlining the required questions.
• Should you decide to use version 9.4 for your validated assessment object, the assessment can be created up to at least 24 months following the release of version 10 (which, as noted above, is slated for the latter part of 2021). The key features of version 9.4 are the addition of the CMMC framework and two community-specific standards, as well as updates to existing sources.

Schellman has performed the role of HITRUST Authorized External Assessor for each of the four versions noted above, with the biggest driving factor being the specific compliance needs for each of those clients and the client’s intended audience. A company that was HITRUST Certified under version 9.1 a year and a half ago might choose to create their assessment object next week and choose version 9.1 again as they are familiar with the framework and they feel that the compliance additions in subsequent versions, as listed above, are not applicable to their business or that they are choosing to cover the compliance initiative in an alternate fashion.

Starting August 1, 2021 if a business has not yet created a validated assessment object, they will be required to choose version 9.4. If a business is working towards their HITRUST Certification but does not feel they will be undergoing the validated assessment portion until 2022, they will be able to choose between version 9.4 and version 10. The required jump to version 10 as the only option when creating a new validated assessment object will not occur until at least the latter part of 2023. HITRUST has yet to announce how long businesses will have to submit their version 9.4 assessments after the deadline to create the object.

Further information about version 10 is forthcoming and will provide additional details for businesses to consider when faced with the challenge of selecting the version that is best suited for their validated assessment needs. Schellman can help facilitate those discussions and share our experiences across a broad range of clients and industries with various compliance needs.