To become HITRUST CSF Certified, an organization must complete a minimum of 156 (typically, many more) rigorous controls (requirements). These controls span across fourteen categories, including risk management, security policy, compliance, and business continuity management. After implementing each control, the organization must be verified via self-assessment or third-party assessor. An organization must be recertified every two years.
For more information on the HITRUST CSF Certification requirements, stop by the Introduction to the HITRUST CSF whitepaper.