The HITRUST Common Security Framework (CSF) v11 is a certifiable framework for regulatory/standards compliance and risk management. It harmonizes requirements from ISO 27001, NIST, PCI DSS, HIPAA, and 40+ other standards into a single assessment.
The CSF pulls requirements from ISO 27001, NIST, PCI DSS, HIPAA, and 40+ other standards into a single certifiable assessment.
It supports three assessment types: e1 (Essential), i1 (Implemented), and r2 (Risk-based).
Official source: https://hitrustalliance.net/hitrust-csf/
ThreeShield's CISSP- and CISA-certified assessors run the HITRUST CSF engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
| Level | What it covers | Builds on the level below |
|---|---|---|
| e1: Essential | Essential cybersecurity hygiene. 44 requirement statements covering fundamental security controls. Suitable for lower-risk organizations or as a starting point. | — |
| i1: Implemented | Leading security practices. 182 requirement statements demonstrating a strong, implemented security program. Suitable for organizations needing to demonstrate good security practices. | Yes |
| r2: Risk-Based | Full risk-based assessment. 300+ requirement statements selected based on organizational risk factors. Required for healthcare organizations handling PHI and high-risk environments. | Yes |
| HITRUST CSF requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
It fits any organization that wants one certifiable framework covering several standards, and the r2 assessment is required for healthcare organizations handling PHI and for high-risk environments. We confirm scope in the first call, at no charge.
A gap assessment against HITRUST CSF usually takes a few weeks. Closing the gaps and standing up the evidence takes longer, and that is where most of the work sits, so the total depends on your starting point. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
ThreeShield meets you at your current security maturity. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You