HITRUST (Is it Information Assurance if you don't trust the Alliance?)
Posted by John Verry on Fri, Aug 28, 2009 @ 04:50 PM
Call me jaded but my level of distrust goes up when an organization:
Perhaps I am just cynical based on our mutual experience with the "Payment Card Industry Standards Council" and the PCI-DSS program which has only succeeded in reducing the risk to the payment brands at the expense of the merchants and the card owners.
My lack of trust in all things PCI-related is well illustrated by the recent "gift card" I gave to my nephew for graduating high school. He called me embarrassed to report that the card balance was zero and that the credit card company had told him that it had already been used. After a considerable time on the line the credit card company finally "admitted" that the card had been used five days prior to my purchasing it. If the credit card companies can't prevent/detect this proactively - what faith can we have in them or their ability to govern?
On learning of HITRUST I was hopeful that it would be different. But on first blush it looks like they have stolen a page or two out of the Payment Card Industry Standards Council playbook. For example, the costs involved for a consulting/auditing firm to be "qualified" exceed $20,000. Initially the standard was only available at a significant cost. On a more positive note, the Alliance recently announced that the Common Security Framework (the standard) will now available for free (however, after 30 minutes on the site today - I still can't find it).
Hopefully, I am wrong and HITRUST will be a shining beacon for Information Assurance - but I'm not so sure. I would rather have a comprehensive, non-industry specific, standard (e.g., ISO-27001) achieve sufficient status that these entities don't feel the need to develop proprietary standards. The benefits would be significant.