06.b.02 Technical compliance of information systems is verified
What the standard requires
The CSF is distributed under a HITRUST subscription licence, so the control text cannot be embedded in this product.
A certifiable control framework that harmonises HIPAA, NIST, ISO 27001, PCI DSS, and other authoritative sources into one control set, with requirements tiered by implementation level so the applicable controls scale with an organization's risk factors.
Get access from HITRUST →If your organisation holds a licence for HITRUST CSF v11, CMDash can load the real text against every control through the framework import, where it is stamped as tenant-provided.
Maps to 3 controls in 3 other frameworks
| Framework | Control |
|---|---|
| FedRAMP Moderate | CA-2 Control assessments |
| HIPAA Security Rule | 164.308(a)(8) Evaluation (R) |
| ISO/IEC 27001:2022 | A.5.36 Compliance with policies, rules and standards for information security |
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.