SECURITY · GLOBAL

HITRUST CSF
Assessment & Implementation

HITRUST Common Security Framework (CSF) v11 — a certifiable framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory/standards compliance and risk management. Harmonizes requirements from ISO 27001, NIST, PCI DSS, HIPAA, and 40+ other standards into a single assessment.

Who This Applies To

Global organizationsSecurity sectorMSPs and their clientsLean IT teams carrying an audit

What HITRUST CSF Covers

HITRUST Common Security Framework (CSF) v11 — a certifiable framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory/standards compliance and risk management. Harmonizes requirements from ISO 27001, NIST, PCI DSS, HIPAA, and 40+ other standards into a single assessment.

Supports e1 (Essential), i1 (Implemented), and r2 (Risk-based) assessment types.

Official source: https://hitrustalliance.net/hitrust-csf/

ThreeShield's CISSP- and CISA-certified assessors run the HITRUST CSF engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.

Assessment Levels We Support

LevelWhat it coversBuilds on the level below
e1 — EssentialEssential cybersecurity hygiene. 44 requirement statements covering fundamental security controls. Suitable for lower-risk organizations or as a starting point.
i1 — ImplementedLeading security practices. 182 requirement statements demonstrating a robust implemented security program. Suitable for organizations needing to demonstrate good security practices.Yes
r2 — Risk-BasedComprehensive risk-based assessment. 300+ requirement statements selected based on organizational risk factors. Required for healthcare organizations handling PHI and high-risk environments.Yes

Where the Work Splits

HITRUST CSF requirementLavawall® collectsThreeShield delivers
Multi-factor authentication status✓ Continuously
Patch and vulnerability posture✓ Continuously
Encryption at rest and in transit✓ Continuously
Access and audit-log review✓ Continuously
Risk assessment and scoping⚑ Platform dataCISSP/CISA-led
Policies, procedures, and evidence packageWritten by ThreeShield

Frequently Asked Questions

If your organization operates in scope for Global or in the security sector, HITRUST CSF likely applies. HITRUST Common Security Framework (CSF) v11 — a certifiable framework that provides organizations with a comprehensive, flexible, and efficient approach to regulatory/standards compliance and risk management. We confirm scope in the first call, at no charge.

It depends on your starting point. A gap assessment against HITRUST CSF is usually a few weeks; closing the gaps and standing up the evidence takes longer and is where most of the work sits. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.

Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.

Three Ways to Engage, from DIY to Done-for-You

ThreeShield meets you at your current security maturity. Every level includes Lavawall®.

Self-Serve

DIY via Lavawall®

For lean IT teams and cost-conscious organizations with internal security capacity

  • Lavawall® GRC with HITRUST CSF control mapping
  • Continuous automated evidence collection
  • Live compliance dashboard and score
  • Policy template library
  • AI-generated status reports
Start with Lavawall®
Recommended for MSPs & Lean IT

Supported

Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity

  • Everything in the DIY tier
  • CISSP/CISA gap assessment
  • Prioritized remediation roadmap
  • Policy and procedure development
  • Quarterly compliance review calls
  • MSP white-label available
Get Supported Engagement
Fully Managed

Done-for-You

Full compliance delivery, managed end to end by ThreeShield

  • Everything in the Supported tier
  • Full compliance program management
  • CISSP/CISA-executed formal assessment
  • Detailed findings methodology
  • Complete documentation package
  • Annual reassessment included
Book Done-for-You

Ready to Get Compliant with HITRUST CSF?

Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.

Book a Scoping Call

DIY · Supported · Done-for-You