HITRUST® October 2025 Quarterly Newsletter 

HITRUST has rolled out a series of enhancements to its user help tools, designed to make the assessment and certification process clearer and more efficient for organizations undergoing a HITRUST assessment. These resources are built to reduce uncertainty and provide support at every stage of compliance.

The enhanced help toolkit includes:

• User guide: A road map for navigating the MyCSF tool’s key features and how to use them effectively  
• Calculators: Interactive dashboards designed to help users better anticipate and plan for the demands of an assessment during key phases, including the:
  • Assessment Tailoring Calculator, which scopes environments by answering various factor questions, ultimately receiving a final count of applicable requirements that will be included in future assessments 
  • Inheritance Calculator, which provides the ability to model inheritance weights and maturity scores for each service provider to see potential outcomes, without submitting live requests in MyCSF 
  • Requirement Scoring Calculator, which provides the ability to explore scoring scenarios in real time by adjusting compliance with maturity levels and also outputs raw scores, PRISMA grades (for example, 2+, 1-), and HITRUST CSF compliance status  
  • Sampling Calculator for various sampling scenarios and frequencies, which can be used to generate sample selections for CSF requirements
  • ROI Calculator, which provides the ability to enter in personalized details and generate an estimate of return on investment (ROI) your organization could achieve with HITRUST certification
• Form templates: A single hub where users can quickly download the most up-to-date versions of key documents, including the Management Representation Letter, Validated Report Agreement, and External Assessor QA Checklist 
• Example reports: Illustrative reporting examples that enable organizations to evaluate assessment options and clearly understand expected deliverables, including certification reports, insights reports, and formal letters 
• References: Links to HITRUST-developed resources, including Assessment and Risk Management Handbooks, AI Security Certification Specification, Factor Descriptions, the MyCSF User Guide, and a comprehensive Glossary of Terms and Acronyms 
• Customer feedback integration: A central mechanism for submitting user feedback to strengthen HITRUST’s adaptability and alignment with the organization’s needs 

AI is transforming every industry, but with rapid adoption comes new risks. HITRUST AI solutions empower organizations to showcase strong security practices to investors, boards, and customers, while staying ahead of evolving regulatory expectations. Further, these solutions help enable a proactive risk posture, helping teams move beyond reactive security measures.

HITRUST AI solutions include:

• AI Security Assessment and Certification
  • 44 controls harmonized with more than 20 authoritative sources 
  • Certification specifically focused on the security of AI systems 
  • Can be added to an e1, i1, or r2 assessment 
  • Designed for AI developers and deployers who require a formal certification to share with customers, regulators, and partners; also ideal for organizations aiming to align their AI security controls with recognized frameworks, such as the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), the International Organization for Standardization (ISO) and International Electrotechnical Commission, and the Open Worldwide Application Security Project, while consolidating compliance efforts and reducing audit fatigue  
• AI Risk Management Assessment 
  • 51 controls aligned with ISO 23894:2023 and NIST AI RMF v1.0 
  • Evaluates governance and oversight of AI risk management practices 
  • Stand-alone assessment or can be added to an e1, i1, or r2 assessment 
  • Best suited for AI users and producers who want a prescriptive mechanism to evaluate risks, organizations seeking a targeted approach to identify gaps, or teams looking to establish or refine an AI risk management program without pursuing formal certification just yet  

With flexible options designed specifically for AI, HITRUST offers these new AI assurance layers that combine actionable detail with independent validation, giving organizations the confidence to innovate and scale AI responsibly.

As you accelerate your AI journey, it’s worth asking: Is your team ready to scale AI securely and responsibly? And do you have a strategy for evaluating risk and proving trust in your systems? HITRUST AI solutions are available to help organizations maintain direction in an evolving landscape.