Which of the following must be confirmed before inheriting requirement scores?
Answer(s): D
HITRUST allows organizations to inherit scores from third-party providers (such as cloud service providers) when those providers have already completed validated HITRUST assessments. For inheritance to be valid, three conditions must be met:The Cross Version IDs (CVIDs) must match between the requirement statement in the provider's assessment and the subscriber's assessment to ensure alignment across framework versions.The requirement must be designated as inheritable by HITRUST; not all requirements are eligible for inheritance.The provider must have published their assessment for inheritance in MyCSF, enabling subscribers to formally link and inherit the validated results.If any of these are missing, inheritance cannot occur. This ensures transparency, consistency, and proper traceability between assessments.
HITRUST MyCSF Guide "Inheritance Process"; CCSFP Study Guide "CVIDs and Inheritable Requirements."
If most of the evaluative elements associated with a requirement statement do not apply to an assessed entity's control environment, the requirement statement can be marked "N/A".
Answer(s): B
HITRUST does not permit marking a requirement statement "Not Applicable" simply because most of the evaluative elements don't apply. Requirement statements are mandatory unless a legitimate scoping or regulatory justification supports exclusion. For example, a control related to cardholder data could be marked N/A only if the organization does not process credit cards. However, if even one evaluative element applies, the requirement must be scored, and the non-applicable elements may be documented as part of evidence. HITRUST QA reviews all N/A designations, requiring organizations to justify exclusions in the Subscriber Comments field. Improperly marking requirements as N/A may result in assessment rejection or mandatory CAPs.
HITRUST Assurance Program "Rules for N/A Designations"; CCSFP Practitioner Guide "Proper Use of N/A in Assessments."
What can the Illustrative Procedures be used for? (Select all that apply)
Answer(s): B,C,D
Illustrative Procedures are example testing steps provided in HITRUST to help assessors evaluate requirement statements consistently. They are not mandatory, but they serve as a guide for developing tailored testing procedures. Their uses include:Implementation testing guidance (B): They show assessors what evidence to look for and how to test control performance.Optional procedures (C): Organizations and assessors may adapt or replace them with equivalent procedures.Test plan foundation (D): Assessors use them as a starting point to design their own testing plans, ensuring consistency and thoroughness.Illustrative Procedures are not used for maintaining consistency between the entity and assessor responses (A), since testing must remain objective and independent. Their purpose is to promote consistent evaluation and reduce ambiguity.
HITRUST CSF Framework "Illustrative Procedures Explained"; CCSFP Practitioner Training "Using Illustrative Procedures in Testing."
Can multiple assessments be performed on your organization simultaneously?
Answer(s): A
Organizations may conduct multiple assessments simultaneously in MyCSF. This may occur when an organization is pursuing different assurance levels (e.g., an r2 assessment for certification while also preparing an i1 for a customer request). It can also happen when separate business units or subsidiaries perform assessments concurrently. MyCSF supports multiple active assessment objects, allowing organizations to scope them independently while managing shared evidence, inheritance, and CAPs across assessments. However, care must be taken to ensure that evidence collection, assessor validation, and QA submissions do not overlap in a way that confuses reporting. HITRUST also provides analytics and dashboards that allow organizations to track multiple assessments at once.
HITRUST MyCSF User Guide "Multiple Assessment Management"; CCSFP Study Guide "Parallel Assessments."
For an r2 assessment, HITRUST requires a Corrective Action Plan (CAP) when the Control Reference required for certification scored a 70 or less, and Implementation scores less than 100%.
In an r2 assessment, CAP requirements are determined at the Control Reference level. If the aggregate score falls below the certification threshold of 71, and the Implementation maturity level is not at 100%, a Corrective Action Plan (CAP) must be documented. This ensures that organizations commit to remediating critical control deficiencies before certification can be finalized. CAPs must include clear details such as responsible parties, remediation steps, and timelines. Without CAPs, HITRUST will not accept the assessment for certification. Even if Policy or Procedure scores are strong, missing implementation creates unacceptable risk. Therefore, HITRUST mandates CAPs in these cases to close certification-critical gaps.
HITRUST Scoring Rubric "CAP Trigger Conditions"; CCSFP Practitioner Guide "CAPs in r2 Certification."
Post your Comments and Discuss HITRUST CCSFP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCSFP content, but please register or login to continue.