The scoring of Requirement Statements is used to calculate the overall Domain score.
Answer(s): A
In HITRUST, scoring follows a hierarchical roll-up process. At the lowest level, Requirement Statements are scored across the five maturity levels: Policy, Procedure, Implemented, Measured, and Managed. These individual requirement scores are then aggregated to produce the Control Reference score. Control Reference scores are averaged to determine the Domain score, and finally, domain scores are used to determine whether certification thresholds are met. Each level of scoring influences the next, meaning deficiencies at the Requirement Statement level impact the higher- level domain performance. This structure ensures that assessments provide a balanced and transparent picture of organizational control effectiveness. No single requirement is hidden; its performance is reflected in the domain-level scoring. Since r2 certifications require each of the 19 domains to score at least 71, accuracy in Requirement Statement scoring is critical.
HITRUST Scoring Rubric "Roll-Up of Scores"; CCSFP Study Guide "From Requirement Statements to Domains."
Which of the following are true with e1, i1, and r2 assessment types? (Select all that apply)
Answer(s): A,B,D
All three validated assessment types--e1, i1, and r2--evaluate controls considered core to cybersecurity hygiene, though at different levels of assurance. For example, e1 is a low-effort model focusing on essential hygiene, i1 is a moderate-assurance model, and r2 is a comprehensive, risk- based model. Requirement statement counts can vary depending on the regulatory and organizational factors selected during scoping. For instance, adding PCI-DSS or HIPAA will increase requirement counts across all types. All assessment types also require testing of implementation, since evidence of operational control performance is mandatory for validation. The incorrect option is C: r2 assessments always include all 19 domains, and so do e1 and i1 assessments. What differs is the number of requirement statements in each domain, not the domains themselves.
HITRUST Assurance Program Overview "Assessment Type Comparison"; CCSFP Study Guide "e1, i1, r2 Requirements and Domains."
HOTSPOTEnter the value assigned to each of the following scoring levels on the HITRUST Scoring Rubric.
Fully Compliant = 100Mostly Compliant = 75Partially Compliant = 50Somewhat Compliant = 25Non-Compliant = 0HITRUST assigns specific numeric values to compliance categories within the scoring rubric to standardize assessments. These categories translate qualitative assessments into quantitative scores:Fully Compliant (100): All criteria met with complete and verified evidence.Mostly Compliant (75): Most criteria met; minor gaps exist.Partially Compliant (50): Roughly half of the evaluative elements are met.Somewhat Compliant (25): Only a small fraction of the evaluative elements are satisfied.Non-Compliant (0): No evidence of compliance.These values are applied at the Requirement Statement level and then averaged upward into Control Reference and Domain scores. This quantification ensures consistency and supports certification thresholds such as the domain-level requirement of 71 for r2 certification.
HITRUST Scoring Rubric "Compliance Categories"; CCSFP Practitioner Guide "Scoring Scales."
When creating a new r2 assessment you are required to use the latest version of the HITRUST CSF.
HITRUST requires that all new r2 assessments use the latest available version of the CSF framework. This ensures that assessments reflect the most current regulatory mappings, authoritative source updates, and industry security practices. For example, if HITRUST releases CSF version 11.x, new assessments initiated after its release must adopt that version. Organizations with ongoing assessments may complete them on the prior version but must transition to the latest version for new engagements. This policy ensures consistency and prevents outdated control sets from being used in certification, which could weaken reliance by stakeholders. Keeping assessments aligned with the current version also reflects HITRUST's commitment to maintaining the CSF as a "living framework."
HITRUST CSF Overview "Framework Updates and Version Requirements"; CCSFP Practitioner Guide "Using the Latest CSF Version in Assessments."
What is an example of a secondary scoping component that could be related to the requirement statement that reads:"The organization destroys (e.g., disk wiping, degaussing, shredding, disintegration, grinding, incineration, pulverization, or melting) media containing sensitive information when it is no longer needed for business or legal reasons."
Secondary scoping components in HITRUST are environmental or supporting elements that contribute to how primary components are protected. For the requirement related to secure destruction of sensitive media, an appropriate secondary scoping component would be shred bins. Shred bins represent the physical mechanism through which media or documents containing sensitive information are collected and securely destroyed. They directly support the requirement for secure media destruction methods. Fire extinguishers, fire bags, trash cans, or storage boxes do not directly relate to this requirement, as they address other aspects of physical safety or storage rather than secure destruction. Including shred bins ensures that physical controls are properly validated as part of secure media disposal processes, aligning with HITRUST's risk-based approach to protecting sensitive data.
HITRUST CSF Assessment Methodology "Primary vs. Secondary Components"; CCSFP Study Guide "Examples of Secondary Scoping Components."
Post your Comments and Discuss HITRUST CCSFP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCSFP content, but please register or login to continue.