Glossary of Compliance

Compliance Glossary

Our list of curated compliance glossary offers everything you to know about compliance in one place.

Glossary » HiTRUST » HITRUST CSF Control Categories

HITRUST CSF Control Categories

HITRUST CSF Control Categories are a bit complex, with over 150 individual controls in total. The exact number of controls your company needs to focus on can vary depending on how you define “control” and your specific compliance needs.

HITRUST organizes its framework into 14 distinct Control Categories, each labeled with a unique identifier from 0.0 to 0.13. These are further organized into 49 objectives and then detailed through 156 references. However, the actual controls your company needs to implement depend on the specifications that apply to your business and other compliance requirements.

The various tiers can get complicated, but the key is to focus on the controls relevant to your organization’s security and compliance needs. Here is the list of controls for your reference.

Control NameControl ObjectivesControl Specifications
Information Security Management Program11
Access Control725
Human Resources Security49
Risk Management14
Security Policy12
Organization of Information Security211
Compliance310
Asset Management25
Physical and Environmental Security213
Communications and Operations Management1032
Information Systems Acquisition, Development, and Maintenance613
Information Security Incident Management25
Business Continuity Management15
Privacy Practices721

Additional reading

Cloud Data Loss Prevention: Key Steps to Safeguard Your Data

Gartner forecast user spending on cloud services to jump by 20.7% in a year – from 2022 to 2023. Given that cloud helps to drive faster time to market, increases flexibility, and reduces operational costs, this number is not unexpected. However, cloud computing is not free from challenges like data loss. Thankfully, cloud data loss…

Operational Compliance: Where Strategy Meets Execution

TL;DR A strong compliance program turns fragmented compliance efforts into predictable, scalable systems your compliance team can actually manage. For SaaS companies selling to financial institutions, meeting strict compliance requirements is the cost of entry—not a nice-to-have. Effective operational risk management helps prevent the silent failures that audits miss but incidents expose. As your SaaS…

What is a Security Questionnaire and Why it Matters?

In the present day, sensitive information, intellectual property, and vital infrastructure can all be compromised by a breach in a vendor’s system, resulting in significant financial loss and damage to an organization’s reputation. According to a survey conducted by Ponemon Institute in 2022, about 56% of respondents claimed that they suffered some form of a…

Sprinto: Your growth superpower

Use Sprinto to centralize security compliance management – so nothing
gets in the way of your moving up and winning big.

Contact sales