Policy is the control-rating dimension for high-level strategic direction and principles that define an organization’s cybersecurity purpose and scope—the why. section 1.5.1
Within HITRUST control assessment, policy works alongside five rating principles:
- Procedure translates policy into detailed implementation instructions. section 1.5.1
- Implemented records the actual application or execution of policies and procedures. section 1.5.1
- Measured assesses control effectiveness continuously, while Managed supports ongoing updates based on measurements. section 1.5.1
Figure 1.2 HITRUST scoring criterion by percentage. The percentages indicate the weights placed on each category for scoring purposes.
The HITRUST scoring criterion shows how assessment weights assigned to policy and related principles contribute to control and certification scores. section 1.5.1
