10.a.01 Security requirements are identified and specified for information systems
What the standard requires
The CSF is distributed under a HITRUST subscription licence, so the control text cannot be embedded in this product.
A certifiable control framework that harmonises HIPAA, NIST, ISO 27001, PCI DSS, and other authoritative sources into one control set, with requirements tiered by implementation level so the applicable controls scale with an organization's risk factors.
Get access from HITRUST →If your organisation holds a licence for HITRUST CSF v11, CMDash can load the real text against every control through the framework import, where it is stamped as tenant-provided.
Maps to 1 control in 1 other framework
| Framework | Control |
|---|---|
| ISO/IEC 27001:2022 | A.8.26 Application security requirements |
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.