The HITRUST CSF’s security safeguards are derived from industry and government frameworks, and cybersecurity requirements including ISO/IEC 27001, HIPAA, security standards, and best practices.