HITRUST CSF v11 control library
Every control CMDash tracks for HITRUST CSF v11, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
The CSF is distributed under a HITRUST subscription licence, so the control text cannot be embedded in this product.
CMDash publishes the identifiers, titles and cross-framework mappings so you can see the shape of what is tracked, and links you to HITRUST Alliance for the document itself. A tenant that holds its own licence can load the real text through the framework import.
Get access from HITRUST →Families
Information Security Management Program · 6
| 00.a.01 | Information security management program is established Maps to FedRAMP Moderate, HIPAA Security Rule, ISO/IEC 27001:2022 +1 more |
| 00.a.02 | Information security program has executive sponsorship |
| 00.a.03 | Information security program is reviewed for adequacy annually |
| 00.a.04 | Information security program roles and responsibilities are documented Maps to HIPAA Security Rule, ISO/IEC 27001:2022 |
| 00.a.05 | Information security program addresses applicable regulatory and contractual obligations |
| 00.a.06 | Information security program objectives and metrics are defined |
Access Control · 27
Human Resources Security · 12
Risk Management · 8
| 03.a.01 | Risk management program is formally established and documented Maps to HIPAA Security Rule, ISO/IEC 27001:2022 |
| 03.a.02 | Risk management methodology and criteria are defined |
| 03.a.03 | Risk management program is periodically reviewed and updated |
| 03.b.01 | Risk assessments are performed at planned intervals or on significant change Maps to FedRAMP Moderate, HIPAA Security Rule, ISO/IEC 27001:2022 +1 more |
| 03.b.02 | Risks identified are documented in a risk register with treatment decisions |
| 03.b.03 | Risks to protected health information receive explicit treatment consideration Maps to HIPAA Security Rule |
| 03.c.01 | Risk treatment plans are approved and monitored to completion Maps to FedRAMP Moderate, HIPAA Security Rule, NIST Cybersecurity Framework (1.1, legacy) |
| 03.c.02 | Residual risks are formally accepted by risk owners |
Security Policy · 5
| 04.a.01 | Information security policy is approved by management and published Maps to FedRAMP Moderate, HIPAA Security Rule, ISO/IEC 27001:2022 |
| 04.a.02 | Information security policy is communicated to employees and relevant external parties |
| 04.a.03 | Subsidiary policies and procedures support the information security policy |
| 04.b.01 | Information security policies are reviewed at planned intervals or on change Maps to ISO/IEC 27001:2022 |
| 04.b.02 | Policy changes are approved and communicated |
Organization of Information Security · 11
Compliance · 15
Asset Management · 10
Physical and Environmental Security · 15
Communications and Operations Management · 38
Information Systems Acquisition, Development, and Maintenance · 19
Information Security Incident Management · 10
Business Continuity Management · 8
| 12.a.01 | Business continuity program integrates information security requirements Maps to FedRAMP Moderate, HIPAA Security Rule, ISO/IEC 27001:2022 +1 more |
| 12.a.02 | Business impact analysis identifies critical processes and recovery priorities Maps to FedRAMP Moderate, HIPAA Security Rule |
| 12.a.03 | Business continuity and disaster-recovery plans are developed for critical processes Maps to FedRAMP Moderate, HIPAA Security Rule, ISO/IEC 27001:2022 |
| 12.a.04 | Continuity plans are tested and maintained at planned intervals Maps to FedRAMP Moderate, HIPAA Security Rule, NIST Cybersecurity Framework (1.1, legacy) |
| 12.a.05 | Redundant information processing facilities support availability requirements Maps to HIPAA Security Rule, ISO/IEC 27001:2022 |
| 12.a.06 | Information processing facilities are protected against unavailability of supporting utilities |
| 12.a.07 | Recovery of healthcare operations is prioritized in continuity plans |
| 12.a.08 | Business continuity plans are communicated to those who need them |
Privacy Practices · 23
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for HITRUST CSF v11 v11.2, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.