Why not upgrade to version 9.5 or 9.6?

If you’ve been using version 9.1 to 9.4, moving to version 11 is recommended to make use of the changes and improvements made to the framework. Version 9.5 and 9.6 will eventually be decommissioned. If you must switch, you might as well invest in upgrading to the latest version to reduce the hassle of multiple version implementations and to leverage the latest enhancements and clarifications made to the requirement statements.

Article

HITRUST CSF version update and new assessment types

April 13, 2023 · Updated Oct. 27, 2023 · Authored by Troy Hawes

The HITRUST CSF is a certifiable security and privacy framework that helps organizations secure, comply, and assess against several security and privacy-related standards, regulations, and recommended practices.

HITRUST is used by organizations in many different highly regulated industries, such as healthcare organizations, technology companies, insurance plan providers, and any organization that handles different classifications of sensitive data.

With its version 11 update, HITRUST has maintained its commitment to improve the framework. The latest version helps organizations better manage risk by staying updated on the current cyberthreat landscape.

HITRUST CSF version 11

HITRUST launched version 11 of the CSF at the beginning of 2023.

HITRUST is decommissioning the version nine.x series. Organizations currently using version 9.1 through 9.4 must switch over to version 11 or a higher version of nine.x — either 9.5 or 9.6 — by 2024.

Timing and deadlines

Organizations have until Dec. 31, 2024, to submit assessments using versions 9.1 through 9.4, but any new assessment objects using these versions had to be created by Sept. 30, 2023.

Organizations currently using versions 9.5 or 9.6 for r2 assessments can continue to use those versions, but they will also be decommissioned in the future.