The measured principle evaluates the ongoing effectiveness of cybersecurity controls and practices through regular assessment and metrics. It represents one of five HITRUST control-rating principles and contributes to a control’s overall score. section 1.5.1
Use the principle to distinguish control maturity:
- Policy defines strategic direction; procedure specifies implementation steps; implemented confirms execution. section 1.5.1
- Measured adds regular evaluation of whether controls and practices are effective, using metrics rather than execution alone. section 1.5.1
- Measured is not mandatory for initial HITRUST certification but supports a mature cybersecurity program and enables managed improvement. section 1.5.1
Figure 1.2 HITRUST scoring criterion by percentage. The percentages indicate the weights placed on each category for scoring purposes.
Use the HITRUST scoring view to see how measured fits among the weighted control-rating categories. section 1.5.1
