Transcription of HITRUST Control Maturity Scoring Rubric (version 3)
{{id}} {{{paragraph}}}
Example: confidence
HITRUST Control Maturity Scoring Rubric (version 3)
HITRUST Control Maturity Scoring Rubric (version 3) HITRUST does not require that policy statements reside in only policy documents or that procedures reside in only procedure documents. They can reside in documents identified as standards, handbooks, guidelines, directives, etc. As specified in the policy illustrative procedures (r2 assessments) and/or evaluative elements (i1 assessments)Managed rating cannot exceed measured coverageRatingRangePoints AwardedNon-Compliant0% - 10%0% of points awardedSomewhat Compliant11% - 32%25% of points awardedPartially Compliant33% - 65%50% of points awardedMostly Compliant66% - 89%75% of points awardedFully Compliant90% -100%100% of points awarded 2022 HITRUSTA llrightsreserved. Anycommercialusesor creations of derivativeworks orutilizedotherthanbeingsharedasis in full, inanyform orby any means,electronical ormechanical,withoutHITRUST % of evaluative elements addressed by theorganization s procedure (Coverage)ProcedureStrengthVery Low0% - 10%Low11% - 32%Moderate33% - 65%High66% - 89%Very High90% - 100%Tier 2 Documented procedurePCMCFCTier 1 Undocumented procedureSCTier 0No procedureNCPOLICY % of evaluative elements addressed by theorganization s policy (Coverage)PolicyStrengthVery Low0% - 10%Low11% - 32%Moderate33% - 65%High66% - 89%Very High90% - 100%Ti
mechanisms to modify risk. Risk treatment options can include avoiding, optimizing, transferring, or retaining [accepting] risk. [ENISA Glossary of Terms] To be classified as a risk treatment process for HITRUST assessment purposes,the process must include: (i) initial involvement of an appropriate level of management or a defined escalation or ...
Tags:
Information
Domain:
Source:
Link to this page:
Please notify us if you found a problem with this document: