HIPAA HITRUST v9.2

ActiveSpecialized framework

Best for: Healthcare organizations and their providers that want to demonstrate their security and compliance in a consistent and streamlined manner. Cloud service providers and covered healthcare entities can also measure compliance against the HITRUST benchmark.

Controls by category

86 controls are Mapped to HIPAA HITRUST v9.2.

0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code

Control	Status
Virtual machines should have automatic protection signature updates configured for Microsoft Antimalware for Azure	Mapped
Windows Server virtual machines should have the default Microsoft IaaSAntimalware extension installed	Mapped
Virtual machines should have system updates installed	Mapped

0301.09o1Organizational.123-09.o 09.07 Media Handling

Control	Status
SQL databases should have transparent data encryption enabled	Mapped

0304.09o3Organizational.1-09.o 09.07 Media Handling

Control	Status
Data Lake Store accounts should have encryption enabled	Mapped
SQL managed instances should use customer-managed keys to encrypt data at rest	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped

0662.09sCSPOrganizational.2-09.s 09.08 Exchange of Information

Control	Status
App Service apps should have 'Client Certificates (Incoming client certificates)' enabled	Mapped

0709.10m1Organizational.1-10.m 10.06 Technical Vulnerability Management

Control	Status
Virtual machines should have a vulnerability assessment solution enabled	Mapped
SQL managed instances should have vulnerability assessment enabled	Mapped
SQL databases should have vulnerability findings resolved	Mapped
SQL servers should have vulnerability assessment enabled	Mapped

0710.10m2Organizational.1-10.m 10.06 Technical Vulnerability Management

Control	Status
SQL managed instances should have vulnerability assessment enabled	Mapped

0711.10m2Organizational.23-10.m 10.06 Technical Vulnerability Management

Control	Status
Virtual machines should have a vulnerability assessment solution enabled	Mapped

0716.10m3Organizational.1-10.m 10.06 Technical Vulnerability Management

Control	Status
SQL databases should have vulnerability findings resolved	Mapped

0719.10m3Organizational.5-10.m 10.06 Technical Vulnerability Management

Control	Status
SQL managed instances should have vulnerability assessment enabled	Mapped

0805.01m1Organizational.12-01.m 01.04 Network Access Control

Control	Status
App Service apps should use a virtual network service endpoint	Mapped
Virtual machines should be in an approved virtual network	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
Container registries should use a virtual network service endpoint	Mapped
Cosmos DB accounts should use a virtual network service endpoint	Mapped
Event Hub namespaces should use a virtual network service endpoint	Mapped
Key vaults should use a virtual network service endpoint	Mapped
Gateway subnets should not have a network security group configured	Mapped
Subnets should have a network security group configured	Mapped
SQL servers should use a virtual network service endpoint	Mapped
Storage accounts should use a virtual network service endpoint	Mapped

0806.01m2Organizational.12356-01.m 01.04 Network Access Control

Control	Status
App Service apps should use a virtual network service endpoint	Mapped
Virtual machines should be in an approved virtual network	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
Container registries should use a virtual network service endpoint	Mapped
Cosmos DB accounts should use a virtual network service endpoint	Mapped
Event Hub namespaces should use a virtual network service endpoint	Mapped
Key vaults should use a virtual network service endpoint	Mapped
Gateway subnets should not have a network security group configured	Mapped
Subnets should have a network security group configured	Mapped
SQL servers should use a virtual network service endpoint	Mapped
Storage accounts should use a virtual network service endpoint	Mapped

0809.01n2Organizational.1234-01.n 01.04 Network Access Control

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped
Virtual machines should be in an approved virtual network	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
Subnets should have a network security group configured	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped
Azure Cache for Redis should allow only secure connections	Mapped
Storage accounts should have secure transfer enabled	Mapped

0810.01n2Organizational.5-01.n 01.04 Network Access Control

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped
Virtual machines should be in an approved virtual network	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
Subnets should have a network security group configured	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped
Azure Cache for Redis should allow only secure connections	Mapped
Storage accounts should have secure transfer enabled	Mapped

0811.01n2Organizational.6-01.n 01.04 Network Access Control

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped
Virtual machines should be in an approved virtual network	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
Subnets should have a network security group configured	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped
Azure Cache for Redis should allow only secure connections	Mapped
Storage accounts should have secure transfer enabled	Mapped

0812.01n2Organizational.8-01.n 01.04 Network Access Control

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped
Virtual machines should be in an approved virtual network	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
Subnets should have a network security group configured	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped
Azure Cache for Redis should allow only secure connections	Mapped
Storage accounts should have secure transfer enabled	Mapped

0814.01n1Organizational.12-01.n 01.04 Network Access Control

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped
Virtual machines should be in an approved virtual network	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
Subnets should have a network security group configured	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped
Azure Cache for Redis should allow only secure connections	Mapped
Storage accounts should have secure transfer enabled	Mapped

0835.09n1Organizational.1-09.n 09.06 Network Security Management

Control	Status
Windows virtual machines should have the network traffic data collection agent installed	Mapped
Virtual machines should use Azure Resource Manager resources	Mapped

0836.09.n2Organizational.1-09.n 09.06 Network Security Management

Control	Status
Linux virtual machines should have the network traffic data collection agent installed	Mapped

0837.09.n2Organizational.2-09.n 09.06 Network Security Management

Control	Status
Azure subscriptions should have Network Watcher enabled	Mapped

0858.09m1Organizational.4-09.m 09.06 Network Security Management

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped
Virtual machines should have all network ports restricted by their associated network security groups	Mapped

0860.09m1Organizational.9-09.m 09.06 Network Security Management

Control	Status
Network security groups should have Diagnostic Settings configured	Mapped

0861.09m2Organizational.67-09.m 09.06 Network Security Management

Control	Status
App Service apps should use a virtual network service endpoint	Mapped

0862.09m2Organizational.8-09.m 09.06 Network Security Management

Control	Status
SQL servers should use a virtual network service endpoint	Mapped

0863.09m2Organizational.910-09.m 09.06 Network Security Management

Control	Status
Event Hub namespaces should use a virtual network service endpoint	Mapped

0864.09m2Organizational.12-09.m 09.06 Network Security Management

Control	Status
Cosmos DB accounts should use a virtual network service endpoint	Mapped

0865.09m2Organizational.13-09.m 09.06 Network Security Management

Control	Status
Key vaults should use a virtual network service endpoint	Mapped

0866.09m3Organizational.1516-09.m 09.06 Network Security Management

Control	Status
Storage accounts should have network access restrictions configured	Mapped

0868.09m3Organizational.18-09.m 09.06 Network Security Management

Control	Status
Container registries should use a virtual network service endpoint	Mapped

0869.09m3Organizational.19-09.m 09.06 Network Security Management

Control	Status
Container registries should use a virtual network service endpoint	Mapped

0870.09m3Organizational.20-09.m 09.06 Network Security Management

Control	Status
Container registries should use a virtual network service endpoint	Mapped

0871.09m3Organizational.22-09.m 09.07 Network Security Management

Control	Status
Container registries should use a virtual network service endpoint	Mapped

0885.09n2Organizational.3-09.n 09.06 Network Security Management

Control	Status
Linux virtual machines should have the network traffic data collection agent installed	Mapped

0886.09n2Organizational.4-09.n 09.06 Network Security Management

Control	Status
Azure subscriptions should have Network Watcher enabled	Mapped

0887.09n2Organizational.5-09.n 09.06 Network Security Management

Control	Status
Windows virtual machines should have the network traffic data collection agent installed	Mapped

0888.09n2Organizational.6-09.n 09.06 Network Security Management

Control	Status
Azure subscriptions should have Network Watcher enabled	Mapped

0894.01m2Organizational.7-01.m 01.04 Network Access Control

Control	Status
App Service apps should use a virtual network service endpoint	Mapped
Virtual machines should be in an approved virtual network	Mapped
Internet-facing virtual machines should use network security groups for protection	Mapped
Container registries should use a virtual network service endpoint	Mapped
Cosmos DB accounts should use a virtual network service endpoint	Mapped
Event Hub namespaces should use a virtual network service endpoint	Mapped
Key vaults should use a virtual network service endpoint	Mapped
Gateway subnets should not have a network security group configured	Mapped
Subnets should have a network security group configured	Mapped
Regions with newly created virtual networks should have Network Watcher deployed	Mapped
SQL servers should use a virtual network service endpoint	Mapped
Storage accounts should use a virtual network service endpoint	Mapped

0901.09s1Organizational.1-09.s 09.08 Exchange of Information

Control	Status
App Service apps should not allow CORS access from every resource	Mapped

0902.09s2Organizational.13-09.s 09.08 Exchange of Information

Control	Status
Function apps should not allow CORS access from every resource	Mapped

0912.09s1Organizational.4-09.s 09.08 Exchange of Information

Control	Status
App Service apps should have remote debugging disabled	Mapped

0913.09s1Organizational.5-09.s 09.08 Exchange of Information

Control	Status
Function apps should have remote debugging disabled	Mapped

0915.09s2Organizational.2-09.s 09.08 Exchange of Information

Control	Status
App Service apps should have Client Certificates (Incoming client certificates) enabled	Mapped

0916.09s2Organizational.4-09.s 09.08 Exchange of Information

Control	Status
App Service apps should not allow CORS access from every resource	Mapped

0943.09y1Organizational.1-09.y 09.09 Electronic Commerce Services

Control	Status
Storage accounts should have secure transfer enabled	Mapped

0947.09y2Organizational.2-09.y 09.09 Electronic Commerce Services

Control	Status
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped

0948.09y2Organizational.3-09.y 09.09 Electronic Commerce Services

Control	Status
MySQL servers should have 'Enforce SSL connection' enabled	Mapped

0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should use the latest TLS version	Mapped
Function apps should require HTTPS for all access	Mapped

0960.09sCSPOrganizational.1-09.s 09.08 Exchange of Information

Control	Status
Function apps should not allow CORS access from every resource	Mapped

11112.01q2Organizational.67-01.q 01.05 Operating System Access Control

Control	Status
Azure subscriptions should limit owners to 3	Mapped

11180.01c3System.6-01.c 01.02 Authorized Access to Information Systems

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped

1119.01j2Organizational.3-01.j 01.04 Network Access Control

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped

1120.09ab3System.9-09.ab 09.10 Monitoring

Control	Status
Azure Monitor should have activity log collection enabled for all regions	Mapped

1143.01c1System.123-01.c 01.02 Authorized Access to Information Systems

Control	Status
Virtual machines should have management ports closed	Mapped

1144.01c1System.4-01.c 01.02 Authorized Access to Information Systems

Control	Status
Azure subscriptions should limit owners to 3	Mapped

1145.01c2System.1-01.c 01.02 Authorized Access to Information Systems

Control	Status
Azure subscriptions should have more than one owner	Mapped

1146.01c2System.23-01.c 01.02 Authorized Access to Information Systems

Control	Status
Azure subscriptions should not have guest accounts with owner permissions	Mapped

1147.01c2System.456-01.c 01.02 Authorized Access to Information Systems

Control	Status
Azure subscriptions should not have blocked accounts with owner permissions	Mapped

1148.01c2System.78-01.c 01.02 Authorized Access to Information Systems

Control	Status
Custom RBAC roles should not be used	Mapped

1150.01c2System.10-01.c 01.02 Authorized Access to Information Systems

Control	Status
Virtual machines should have management ports closed	Mapped

1151.01c3System.1-01.c 01.02 Authorized Access to Information Systems

Control	Status
Azure subscriptions should limit owners to 3	Mapped

1152.01c3System.2-01.c 01.02 Authorized Access to Information Systems

Control	Status
Azure subscriptions should have more than one owner	Mapped

1153.01c3System.35-01.c 01.02 Authorized Access to Information Systems

Control	Status
Kubernetes clusters should use Role-Based Access Control (RBAC)	Mapped

1175.01j1Organizational.8-01.j 01.04 Network Access Control

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped

1179.01j3Organizational.1-01.j 01.04 Network Access Control

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped

1192.01l1Organizational.1-01.l 01.04 Network Access Control

Control	Status
Virtual machines should use just-in-time network access control for management ports	Mapped

1193.01l2Organizational.13-01.l 01.04 Network Access Control

Control	Status
Virtual machines should have management ports closed	Mapped

1194.01l2Organizational.2-01.l 01.04 Network Access Control

Control	Status
App Service apps should have remote debugging disabled	Mapped

1195.01l3Organizational.1-01.l 01.04 Network Access Control

Control	Status
Function apps should have remote debugging disabled	Mapped

1202.09aa1System.1-09.aa 09.10 Monitoring

Control	Status
Data Lake Store accounts should have resource logs enabled	Mapped

1203.09aa1System.2-09.aa 09.10 Monitoring

Control	Status
Logic App workflows should have resource logs enabled	Mapped

1204.09aa1System.3-09.aa 09.10 Monitoring

Control	Status
IoT hubs should have resource logs enabled	Mapped

1205.09aa2System.1-09.aa 09.10 Monitoring

Control	Status
Batch accounts should have resource logs enabled	Mapped

1207.09aa2System.4-09.aa 09.10 Monitoring

Control	Status
Event Hub namespaces should have resource logs enabled	Mapped
Stream Analytics jobs should have resource logs enabled	Mapped

1208.09aa3System.1-09.aa 09.10 Monitoring

Control	Status
Search services should have resource logs enabled	Mapped
Service Bus namespaces should have resource logs enabled	Mapped

1209.09aa3System.2-09.aa 09.10 Monitoring

Control	Status
App Service apps should have resource logs enabled	Mapped

1210.09aa3System.3-09.aa 09.10 Monitoring

Control	Status
Data Lake Analytics accounts should have resource logs enabled	Mapped

12100.09ab2System.15-09.ab 09.10 Monitoring

Control	Status
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped

12101.09ab1Organizational.3-09.ab 09.10 Monitoring

Control	Status
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped

12102.09ab1Organizational.4-09.ab 09.10 Monitoring

Control	Status
Windows machines should have the Log Analytics agent connected as expected	Mapped

1211.09aa3System.4-09.aa 09.10 Monitoring

Control	Status
Key vaults should have resource logs enabled	Mapped
Key Vault Managed HSMs should have resource logs enabled	Mapped
SQL servers should have auditing enabled	Mapped

1212.09ab1System.1-09.ab 09.10 Monitoring

Control	Status
Azure Monitor log profiles should have log collection enabled for 'write', 'delete', and 'action' categories	Mapped

1213.09ab2System.128-09.ab 09.10 Monitoring

Control	Status
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped

1214.09ab2System.3456-09.ab 09.10 Monitoring

Control	Status
Azure Monitor should have activity log collection enabled for all regions	Mapped

1215.09ab2System.7-09.ab 09.10 Monitoring

Control	Status
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped

1216.09ab3System.12-09.ab 09.10 Monitoring

Control	Status
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring	Mapped

1217.09ab3System.3-09.ab 09.10 Monitoring

Control	Status
Windows machines should have the Log Analytics agent connected as expected	Mapped

1219.09ab3System.10-09.ab 09.10 Monitoring

Control	Status
Azure Monitor log profiles should have log collection enabled for 'write', 'delete', and 'action' categories	Mapped

1220.09ab3System.56-09.ab 09.10 Monitoring

Control	Status
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled	Mapped

1229.09c1Organizational.1-09.c 09.01 Documented Operating Procedures

Control	Status
Kubernetes clusters should use Role-Based Access Control (RBAC)	Mapped

1230.09c2Organizational.1-09.c 09.01 Documented Operating Procedures

Control	Status
Custom RBAC roles should not be used	Mapped

1232.09c3Organizational.12-09.c 09.01 Documented Operating Procedures

Control	Status
Network security groups should have RDP access restrictions configured	Mapped

1270.09ad1System.12-09.ad 09.10 Monitoring

Control	Status
Azure subscriptions should have an Activity Log Alert configured for specific Administrative operations	Mapped

1271.09ad1System.1-09.ad 09.10 Monitoring

Control	Status
Azure subscriptions should have an Activity Log Alert configured for specific Administrative operations	Mapped

1325.09s1Organizational.3-09.s 09.08 Exchange of Information

Control	Status
Function apps should have remote debugging disabled	Mapped

1450.05i2Organizational.2-05.i 05.02 External Parties

Control	Status
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped

1451.05iCSPOrganizational.2-05.i 05.02 External Parties

Control	Status
Azure Cache for Redis should allow only secure connections	Mapped

1616.09l1Organizational.16-09.l 09.05 Information Back-Up

Control	Status
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped

1617.09l1Organizational.23-09.l 09.05 Information Back-Up

Control	Status
MySQL servers should have geo-redundant backup enabled	Mapped

1618.09l1Organizational.45-09.l 09.05 Information Back-Up

Control	Status
PostgreSQL servers should have geo-redundant backup enabled	Mapped

1619.09l1Organizational.7-09.l 09.05 Information Back-Up

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped

1621.09l2Organizational.1-09.l 09.05 Information Back-Up

Control	Status
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped

1622.09l2Organizational.23-09.l 09.05 Information Back-Up

Control	Status
MySQL servers should have geo-redundant backup enabled	Mapped

1623.09l2Organizational.4-09.l 09.05 Information Back-Up

Control	Status
PostgreSQL servers should have geo-redundant backup enabled	Mapped

1624.09l3Organizational.12-09.l 09.05 Information Back-Up

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped

1626.09l3Organizational.5-09.l 09.05 Information Back-Up

Control	Status
PostgreSQL servers should have geo-redundant backup enabled	Mapped

1627.09l3Organizational.6-09.l 09.05 Information Back-Up

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped

1634.12b1Organizational.1-12.b 12.01 Information Security Aspects of Business Continuity Management

Control	Status
Virtual machines should have disaster recovery configured	Mapped

1635.12b1Organizational.2-12.b 12.01 Information Security Aspects of Business Continuity Management

Control	Status
Key Vault Managed HSMs should have purge protection enabled	Mapped
Key vaults should have deletion protection enabled	Mapped

1638.12b2Organizational.345-12.b 12.01 Information Security Aspects of Business Continuity Management

Control	Status
Virtual machines should have disaster recovery configured	Mapped

Other

Control	Status
Function apps should use managed identity	Mapped
App Service web apps should require HTTPS for all access	Mapped
App Service apps should use managed identity	Mapped
Azure subscriptions should not have blocked accounts with read and write permissions	Mapped
Azure subscriptions should not have guest accounts with read permissions	Mapped
Azure subscriptions should not have guest accounts with write permissions	Mapped

Framework	Control overlap	Note
NIST SP 800-53 Rev 5	High 72%
FedRAMP High	High 71%
NIST SP 800-171 Rev 2	High 69%

Frequently asked questions

Who creates and maintains the HITRUST CSF?

HITRUST is an organization governed by representatives from the healthcare industry. It created and maintains the Common Security Framework (CSF), a certifiable framework for demonstrating security and compliance.

What is the structure of the HITRUST CSF?

The CSF contains 14 control categories, comprised of 49 control objectives and 156 control specifications. HITRUST certifies IT offerings against these controls and adapts certification requirements to organizational, regulatory, and system risk factors.

What assessment levels does HITRUST offer?

HITRUST offers three degrees of assurance. These are a self-assessment that generates a readiness assessment report, HITRUST CSF Validated, and HITRUST CSF Validated Certified. Validated assessments are performed onsite by a HITRUST authorized external assessor.

Does using Azure make an organization HITRUST compliant?

No. The customer is ultimately responsible for its own HITRUST CSF compliance. The Azure HITRUST shared responsibility matrix describes which responsibilities are owned by Microsoft, by the customer, or shared by both.