HITRUST Common Security Framework v11
Comprehensive security framework widely adopted in healthcare, integrating requirements from HIPAA, NIST 800-53, ISO 27001, PCI DSS, and other standards. 14 control categories covering information security management, access control, human resources security, risk management, security policy, organisation of information security, compliance, asset management, physical and environmental security, communications and operations management, information systems development, incident management, business continuity, and privacy practices. Supports three assessment types: e1 (essential), i1 (implemented), and r2 (risk-based validated).
| Clause | Title | SP 800-53 Controls |
|---|---|---|
| 00.a | Information Security Management Program — ISMS Establishment and Governance | |
| 00.b | Information Security Management Program — Risk Management Framework | |
| 00.c | Information Security Management Program — Programme Maintenance and Continuous Improvement | |
| 01.a | Access Control — Access Control Policy and User Registration | |
| 01.b | Access Control — Network Access Control | |
| 01.c | Access Control — Operating System and Application Access Control | |
| 01.d | Access Control — Mobile Computing and Teleworking | |
| 02.a | Human Resources Security — Prior to Employment | |
| 02.b | Human Resources Security — During Employment | |
| 02.c | Human Resources Security — Termination and Change of Employment | |
| 03.a | Risk Management — Risk Assessment Methodology and Execution | |
| 03.b | Risk Management — Risk Treatment and Monitoring | |
| 04.a | Security Policy — Information Security Policy Document and Review | |
| 04.b | Security Policy — Policy Review, Exception Management, and Compliance Monitoring | |
| 05.a | Organisation of Information Security — Internal Organisation and Security Roles | |
| 05.b | Organisation of Information Security — External Parties and Third-Party Risk | |
| 05.c | Organisation of Information Security — Mobile Devices and Remote Working Policy | |
| 06.a | Compliance — Legal and Regulatory Requirements Identification | |
| 06.b | Compliance — Intellectual Property, Records Management, and Data Protection | |
| 06.c | Compliance — Security Reviews, Audits, and Technical Compliance | |
| 07.a | Asset Management — Asset Inventory and Ownership | |
| 07.b | Asset Management — Information Classification and Handling | |
| 08.a | Physical and Environmental Security — Secure Areas and Facility Access | |
| 08.b | Physical and Environmental Security — Equipment Security and Protection | |
| 09.a | Communications and Operations Management — Operational Procedures and Responsibilities | |
| 09.b | Communications and Operations Management — Capacity Management and System Acceptance | |
| 09.c | Communications and Operations Management — Malware Protection and Technical Vulnerability Management | |
| 09.d | Communications and Operations Management — Backup and Recovery | |
| 09.e | Communications and Operations Management — Network Security Management | |
| 09.f | Communications and Operations Management — Media Handling and Information Exchange | |
| 09.g | Communications and Operations Management — Monitoring, Logging, and Audit | |
| 10.a | Information Systems Acquisition, Development, and Maintenance — Security Requirements Analysis | |
| 10.b | Information Systems Acquisition, Development, and Maintenance — Correct Processing and Input/Output Validation | |
| 10.c | Information Systems Acquisition, Development, and Maintenance — Cryptographic Controls | |
| 10.d | Information Systems Acquisition, Development, and Maintenance — Security in Development and Support Processes | |
| 10.e | Information Systems Acquisition, Development, and Maintenance — Technical Vulnerability Management | |
| 11.a | Information Security Incident Management — Incident Reporting and Response | |
| 11.b | Information Security Incident Management — Incident Management and Improvement | |
| 11.c | Information Security Incident Management — Evidence Collection and Forensic Readiness | |
| 12.a | Business Continuity Management — BCM Framework and Business Impact Analysis | |
| 12.b | Business Continuity Management — Business Continuity Plans and Implementation | |
| 12.c | Business Continuity Management — Testing, Maintenance, and Reassessment | |
| 13.a | Privacy Practices — Privacy Programme Establishment and Governance | |
| 13.b | Privacy Practices — Notice, Consent, and Choice | |
| 13.c | Privacy Practices — Collection Limitation, Use, Disclosure, and Retention | |
| 13.d | Privacy Practices — Individual Access, Amendment, and Complaints | |
| 13.e | Privacy Practices — Health-Specific Privacy Requirements (PHI/ePHI) |