Skip to main content
HITRUST CSF (Common Security Framework) is a certifiable security framework that incorporates requirements from multiple standards and regulations including HIPAA, SOC 2, ISO 27001, NIST, and PCI DSS. It is widely used in healthcare but applicable to any industry.

​
Who needs HITRUST?

Healthcare organizations

Hospitals, health plans, and healthcare technology companies that need to demonstrate comprehensive security compliance.

Business associates

Vendors serving healthcare clients who need a certification that satisfies multiple compliance requirements simultaneously.

​
HITRUST assessment types

​
How DSALTA helps

  • HITRUST controls mapped to CSF requirements
  • Cross-framework efficiency — leverages existing SOC 2, ISO 27001, and HIPAA evidence
  • Risk-based scoping aligned with HITRUST methodology
  • Evidence collection automated through integrations

​
Frequently asked questions

HITRUST is a prescriptive framework with specific requirements, while SOC 2 is criteria-based and more flexible. HITRUST is preferred in healthcare; SOC 2 is more common in general SaaS.
Yes. HITRUST incorporates SOC 2 requirements. DSALTA maps overlapping controls, so existing SOC 2 evidence accelerates HITRUST certification.

​
How DSALTA automates this

315 of DSALTA’s automated checks contribute evidence to this framework, drawn from 73 integrations. Browse them in the Compliance Tests catalog. They are linked through the controls each check satisfies, so a single check usually contributes to several frameworks at once — the count is not a list of checks unique to this one.