How do I apply?
Thank you for your interest in applying for the HITRUST CSF Assurance Program. EHNAC-accredited organizations, as well as candidates for EHNAC accreditation, are eligible to choose EHNAC as their HITRUST CSF Assessor. After completing your EHNAC Application, perform the five steps below to begin your HITRUST CSF Certification.
1. Purchase from HITRUST, a “MyCSF Subscription and Report.”
Note: The minimum subscription that must be purchased is the Professional license.
• To purchase a subscription to MyCSF, fill out the form at https://hitrustalliance.net/mycsf/ or call HITRUST at 855-448-7878
• To learn more about the MyCSF tool, view the 18-minute video at https://hitrustalliance.net/mycsf/. This video is referenced within the following steps below.
2. Learn about the HITRUST process and details on how to use MyCSF by viewing the videos available at the HITRUST website
(see https://hitrustalliance.net/mycsf/training-videos/ and https://hitrustalliance.net/mycsfvideos/) and/or by viewing videos and documents linked to within the MyCSF tool.
3. Once a subscription to MyCSF has been obtained, enter your organization’s Administrative and Scoping Information (also known as “Risk Factors”) into MyCSF (go to 4:25 in the MyCSF video). Within that section, ensure the following:
Select one of the following as the Assessment Option:
• CSF Security Assessment,
• CSF Security & Privacy Assessment,
• CSF Comprehensive Security Assessment, or
• CSF Comprehensive Security & Privacy Assessment
Select “Validated Assessment” as the Assessment Type
By selecting Validated Assessment as the Assessment Type, you will in the end either receive a Validated Report or a Validated Report with Certification, depending on your score.
Select EHNAC as the Assessor Organization
After completing the Factors section, press the “Preview Assessment Count” (not shown in the video, but found at the bottom of the Factors screen) to see the number of Requirement Statements (also known as “Implementation Requirements”) that will be assessed. This number must be reported to EHNAC for scoping and pricing purposes.
4. EHNAC will develop a Statement of Work (SOW) that will be sent to you, as the candidate, which will review pricing and review the scope of work to be completed. A call will be scheduled to review the SOW and determine any adjustments necessary to finalize, approve and execute the SOW and commence the assessment with the agreed upon timeline.
5. Two forms must at this point be submitted to HITRUST
EHNAC and the Candidate must submit the following documents to HITRUST demonstrating the relationship between the Candidate and the Assessor:
• HITRUST Validated Assessment Form (obtained upon request from HITRUST or you may request this from EHNAC.) Once HITRUST receives the Validated Assessment Form, EHNAC will be provided access to your information within MyCSF and will begin assessing the information.
• 3rd Party Participation Agreement
If you have any questions about anything, including the steps above, please don’t hesitate to contact Debra Hopkinson at firstname.lastname@example.org .