11.a.01 Information security events are reported through appropriate management channels
What the standard requires
The CSF is distributed under a HITRUST subscription licence, so the control text cannot be embedded in this product.
A certifiable control framework that harmonises HIPAA, NIST, ISO 27001, PCI DSS, and other authoritative sources into one control set, with requirements tiered by implementation level so the applicable controls scale with an organization's risk factors.
Get access from HITRUST →If your organisation holds a licence for HITRUST CSF v11, CMDash can load the real text against every control through the framework import, where it is stamped as tenant-provided.
Maps to 2 controls in 2 other frameworks
| Framework | Control |
|---|---|
| FedRAMP Moderate | IR-6 Incident reporting |
| ISO/IEC 27001:2022 | A.6.8 Information security event reporting |
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
Integrations that carry evidence for this family
These connectors produce data relevant to HITRUST CSF v11’s Information Security Incident Management family, which is the granularity CMDash publishes — there is no pre-built per-control mapping, and claiming one would be inventing it. You decide which evidence answers which control.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.