MENU
For the maturity levels "Measured" and "Managed," any score above 50% requires the following supporting documentation. (Select all that apply)
When scoring Measured and Managed maturity levels in HITRUST, evidence requirements are more rigorous. If these levels are scored above 50%, organizations must demonstrate that formal processes exist to measure control performance, that reports are generated to monitor effectiveness, and that accountability for measurement and management is assigned. Specifically:
Processes show how control gaps are tracked, risks mitigated, and remediation addressed.
Reports provide tangible outputs proving monitoring activities (e.g., audit logs, vulnerability reports).
Responsible individuals must be identified to show governance and ownership of measurement functions.
Organizational scoping factors, while important for tailoring requirements, do not serve as evidence of maturity scoring. HITRUST's QA team requires this documentation to confirm that high maturity levels are not claimed without demonstrable evidence of ongoing monitoring and governance.