HITRUST CSF v11
The v11 control set for organizations whose customers require HITRUST.
What HITRUST CSF v11 is
HITRUST CSF is a certifiable control framework built by harmonising other frameworks — HIPAA, ISO 27001, NIST, PCI DSS and others — into a single prescriptive set. Its appeal in US healthcare is precisely that prescriptiveness: HIPAA tells you to implement "reasonable and appropriate" safeguards, which two organisations can interpret entirely differently, whereas HITRUST tells you what to implement and at what level.
The v11 releases restructured the assessment portfolio into e1 (essentials, a small set), i1 (implemented, one year) and r2 (risk-based, two years). The r2 assessment is the one buyers mean when they say "HITRUST certified", and it is scoped by implementation level: Level 1 and Level 2 requirements form the baseline that the large majority of certifying organisations are assessed against, with Level 3 reserved for the largest regulated enterprises.
Certification is issued only by a HITRUST-Authorized External Assessor Organization, and the assessment is scored on a maturity model — policy, procedure, implemented, measured, managed — rather than a binary implemented/not. That is a meaningful difference from every other framework here.
Who it applies to
- Health-tech vendors, payers, providers and clearinghouses whose customers have escalated from "are you HIPAA compliant" to "are you HITRUST certified".
- Existing HIPAA-covered entities and business associates for whom HITRUST is the natural upgrade path — the crosswalk between the two is the largest HIPAA mapping in the catalogue.
- Organisations handling PHI at scale where a customer contract names HITRUST specifically.
How it is structured in CMDash
CMDash seeds the r2 baseline — Implementation Levels 1 and 2 — across fourteen control categories, using HITRUST's own category / objective / reference numbering so that requirement identifiers match what an assessor works from.
| Information Security Management Program | 6 |
| Access Control | 27 |
| Human Resources Security | 12 |
| Risk Management | 8 |
| Security Policy | 5 |
| Organization of Information Security | 11 |
| Compliance | 15 |
| Asset Management | 10 |
| Physical and Environmental Security | 15 |
| Communications and Operations Management | 38 |
| Information Systems Acquisition, Development, and Maintenance | 19 |
| Information Security Incident Management | 10 |
| Business Continuity Management | 8 |
| Privacy Practices | 23 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
Scope: r2 baseline, Implementation Levels 1 and 2.
The control text
The CSF is distributed under a HITRUST subscription licence, so the control text cannot be embedded in this product.
CMDash ships the control identifiers, the titles, and its own evidence-requirement guidance. If you hold a licence, you can import the official text yourself through the framework CSV import, which records it as customer-provided.
Get access from HITRUST →Distributed under a publisher subscription
What CMDash does for HITRUST CSF v11
- The r2 Level 1 + 2 requirement set tracked individually, which is the largest control set in the catalogue after FedRAMP.
- The heaviest crosswalk coverage of any attestation framework here: seeded mappings to ISO 27001:2022, HIPAA, FedRAMP and NIST CSF. For an organisation coming from HIPAA, that mapping is the difference between a fresh start and an extension.
- Dated evidence and reviewer workflow per requirement, plus the evidence package ZIP export for handing to an authorised external assessor.
- A read-only, expiring assessor seat scoped to HITRUST alone, with a record of what was accessed.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to HITRUST CSF v11’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- Level 3 implementation requirements are not seeded. They apply mainly to the largest regulated healthcare enterprises, and the scope shipped is the Level 1 + 2 r2 baseline.
- HITRUST licenses the CSF content. CMDash ships requirement identifiers, titles and its own evidence guidance rather than reproducing HITRUST's text.
- HITRUST's maturity-level scoring model — policy, procedure, implemented, measured, managed — is not modelled per requirement. CMDash tracks implementation status, not the five-level PRISMA-derived maturity score an r2 assessment produces.
- Certification is issued exclusively by a HITRUST-Authorized External Assessor Organization. CMDash provides the evidence machinery, not the certification.
Common questions
We are HIPAA compliant. Why would we do HITRUST?
Because your customers cannot verify HIPAA compliance and can verify a HITRUST certificate. HIPAA has no certification regime — an organisation self-declares. HITRUST gives a buyer a third-party assessed answer, which is why health systems increasingly require it from vendors regardless of what HIPAA says.
Which assessment type do we need?
r2 is what "HITRUST certified" normally means and what CMDash seeds. e1 and i1 are lighter assessments with their own requirement subsets and are not separately modelled here — if your customer named e1 or i1 specifically, check the scope before assuming this control set matches.
Does CMDash score the maturity levels?
No. An r2 assessment scores each requirement across policy, procedure, implemented, measured and managed. CMDash tracks implementation status and evidence; the maturity scoring is done in the assessment itself. That is a real gap and it is better stated than discovered.
Also in Audit & Attestation
Paid plans cap how many frameworks you run at once, never which ones — HITRUST CSF v11 is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.