HITRUST requires that each of the19 domainsachieve a minimum score of71for an organization to qualify for r2 certification. This threshold ensures that entities maintain a consistent level of maturity across all control areas, rather than excelling in some while neglecting others. The 71 threshold is calculated from the weighted average of requirement statements within a domain, factoring in Policy, Procedure, and Implementation maturity scores (with Measured and Managed as applicable). If any domain falls below 71, the assessment may still produce a validated report, but it will not result in certification. This strict requirement highlights HITRUST's emphasis onbalanced coverageacross all areas of security and privacy.
References:HITRUST CSF Scoring Rubric - "Certification Thresholds"; CCSFP Practitioner Guide -
"Minimum Domain Score Requirements."

When a Requirement Statement's responsibility is shared between a client and service providers (e.g., cloud vendors or managed security providers), HITRUST requires ablended scoring approach. Assessors must evaluate all parties' contributions and assign a composite score that reflects the total control environment.
This prevents organizations from over-relying on inherited provider scores without demonstrating their own responsibilities (e.g., configuration, monitoring). It also prevents dismissing requirements as N/A since partial responsibility still exists. By combining the provider's validated assessment results with the client's implementation evidence, HITRUST ensures a complete and accurate reflection of risk. Sole reliance on provider scores would overlook gaps in client-side processes.
References:HITRUST Inheritance Guidance - "Blended Scoring of Shared Responsibility"; CCSFP Practitioner Guide - "Scoring Split Responsibility."

HITRUST uses a scoring scale from 0 to 100, with categories for Fully Compliant, Mostly Compliant, Partially Compliant, Somewhat Compliant, and Non-Compliant. A score of37falls into the "Somewhat Compliant" category. This reflects significant weaknesses in Policy, Procedure, or Implementation maturity levels. Such a low score indicates agapthat must be addressed. Depending on whether the control is required for certification, HITRUST may require aCorrective Action Plan (CAP). CAPs are required when certification-critical controls score below thresholds (e.g., Implementation not at 100% where required).
Therefore, a Requirement Statement score of 37 would be treated as agap with a possible required CAP, depending on its criticality within the certification process.
References:HITRUST CSF Scoring Rubric - "Compliance Categories and CAP Triggers"; CCSFP Study Guide - "Requirement Scoring Outcomes."

If management decides to add new systems mid-assessment, the assessor must ensure the assessment scope and related requirement statements reflect the change. In MyCSF, this means two actions: first,reverting all completed Requirement Statementsso that the client can review and adjust responses for any new control impacts. Second, the assessor mustupdate the "Scope of the Assessment" tabto include the new systems.
This ensures that MyCSF recalculates applicable requirements based on the expanded scope. Removing authoritative sources or requesting a Bridge Certificate would not address this situation, as authoritative sources are regulatory mappings and bridge certificates are only used to extend certifications temporarily.
References:HITRUST CSF Assurance Methodology - "Adjusting Scope During Assessments"; CCSFP Practitioner Guide - "Scope Changes in MyCSF."

When performing HITRUST scoping, organizations must includeregulatory factorsrelevant to their operational and geographic context. Since this entity operates inMassachusettsandNevada, two state-specific privacy and security laws apply:
* Massachusetts Data Protection Act(201 CMR 17.00): Requires businesses handling personal data of Massachusetts residents to maintain a written information security program (WISP), including encryption and monitoring controls.
* Nevada Security of Personal Information Law(NRS 603A): Mandates encryption for personal information stored or transmitted electronically and requires reasonable security measures.
TheCMS Minimum Security Requirements (High)(B) would apply only if the entity processes Medicare
/Medicaid-related data. TheTexas Health and Safety Code(D) applies only to Texas-based covered entities.
Subject to De-ID Requirements(E) is a general data-handling condition, not a state-specific regulatory factor.
Therefore, onlyMassachusetts Data Protection ActandNevada Security of Personal Information Requirementsapply in this scenario.
References:HITRUST CSF Assurance Program - "Regulatory Factor Scoping"; CCSFP Study Guide -
"State-Specific Regulatory Factors."