How do I apply?

Thank you for your interest in applying for the HITRUST CSF Assurance Program. EHNAC-accredited organizations, as well as candidates for EHNAC accreditation, are eligible to choose EHNAC as their HITRUST CSF Assessor. After completing your EHNAC Application, perform the five steps below to begin your HITRUST CSF Certification.

1. Purchase from HITRUST, a “MyCSF Subscription and Report.”

Note: The minimum subscription that must be purchased is the Professional license.

• To purchase a subscription to MyCSF, fill out the form at https://hitrustalliance.net/mycsf/ or call HITRUST at 855-448-7878

• To learn more about the MyCSF tool, view the 18-minute video at https://hitrustalliance.net/mycsf/. This video is referenced within the following steps below.

2. Learn about the HITRUST process and details on how to use MyCSF by viewing the videos available at the HITRUST website
(see https://hitrustalliance.net/mycsf/training-videos/ and https://hitrustalliance.net/mycsfvideos/) and/or by viewing videos and documents linked to within the MyCSF tool.

3. Once a subscription to MyCSF has been obtained, enter your organization’s Administrative and Scoping Information (also known as “Risk Factors”) into MyCSF (go to 4:25 in the MyCSF video).  Within that section, ensure the following:

Select one of the following as the Assessment Option:

• CSF Security Assessment,
• CSF Security & Privacy Assessment,
• CSF Comprehensive Security Assessment, or
• CSF Comprehensive Security & Privacy Assessment

Select “Validated Assessment” as the Assessment Type

By selecting Validated Assessment as the Assessment Type, you will in the end either receive a Validated Report or a Validated Report with Certification, depending on your score.

Select EHNAC as the Assessor Organization

After completing the Factors section, press the “Preview Assessment Count” (not shown in the video, but found at the bottom of the Factors screen) to see the number of Requirement Statements (also known as “Implementation Requirements”) that will be assessed. This number must be reported to EHNAC for scoping and pricing purposes.

4. EHNAC will develop a Statement of Work (SOW) that will be sent to you, as the candidate, which will review pricing and review the scope of work to be completed. A call will be scheduled to review the SOW and determine any adjustments necessary to finalize, approve and execute the SOW and commence the assessment with the agreed upon timeline.

5. Two forms will also need to be completed.   These forms are contained within the MYCSF tool and are needed to demonstrate the relationship between the Candidate and the Assessor:

• HITRUST Validated Assessment Form

• 3rd Party Participation Agreement

If you have any questions about anything, including the steps above, please don’t hesitate to contact Susan Flynn, Operations Manager at Accreditation@DirectTrust.org.