Information Security Blog

3 Differences of ISO 27001 & HITRUST Certification for Healthcare

27001-vs-hitrust A colleague asked me about my opinion on the differences between HITRUST Certification and ISO 27001 Certification. More specifically, he asked three very important questions. I decided to share my thoughts and reply on the blog because I believe it will provide a lot of value readers.

1) ISO Certification focuses on the Information Security Management System. What would you say the focus of HITRUST is?

ISO does indeed focus on the ISMS… more specifically a risk assessment/management focused ISMS leveraging the 27002 control set to mitigate the risks to an acceptable level. I would argue that HITRUST is focused on providing a prescriptive set of controls that are cross mapped and referenced to standards and regulations relevant to healthcare to simplify the process of becoming largely compliant with relevant laws and regulations and mitigating most risks that a typical hospital has to an acceptable level. An over-simplified view is that HITRUST is a set of predefined controls for an assumed set of risks and compliance requirements – with an IT-GRC like mapping. It’s a pre-customized CSF in a box.

2) If a company became ISO certified, what is the remaining effort to become HITRUST certified?

If an organization was ISO-27001 certified and scoped the certificate to the same information & processes that HITRUST covered – I think the organization would need to extend a small amount of additional effort. HITRUST simplifies this process by cross-mapping the 27002 controls to HITRUST. Although HITRUST “assumes” a set of risks it also includes a Statement of Applicability (like 27001) – so I think there would be little chance that the 27001 driven ISMS would not fully match the HITRUST defined ISMS.

3) If a company became HITRUST certified, what is the remaining effort to become ISO 27001 certified?

If an organization was HITRUST certified using levels of HITRUST applicability equivalent to what the ISO 27001 applicability would be – I think the organization would need to extend a small amount of additional effort.

Which To Do First?

So, the obvious question is if I’m going to do both – which should I do first? As the primary driver for both 27001 and HITRUST are often attestation – I think the most important question is – which form is more important right now? Assuming neither has a greater sense of urgency – I think ISO-27001 has the advantage of broader acceptance and better addresses potential risks non-specific to HITRUST. It would likely take a little longer on the front end – but adding HITRUST would probably be faster on the back-end. I think HITRUST has the advantage of being a bit “simpler” as the risks and risk treatments are largely defined. It would be a little faster on the front end – but adding ISO-27001 on the back end would probably be slower as some of the artifacts (e.g., the Risk assessment) may not have been fully developed for HITRUST.

More About ISO 27001 & HITRUST Certification

About a year ago I blogged about HITRUST in an article called HITRUST vs. ISO-27001 (or is it?), and I think the three points say the same thing in a slightly different way.

Free Download: ISO 27001 Implementation Roadmap

Have no fear – our “roadmap” will guide you, step by step, through the entire ISO 27001 process.

Getting to ISO 27001 certification is a process made up of things you already know – and things you may already be doing!

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

Substantiate the net effectiveness of a mature control environment
Prove to a third party that an environment is secure/trustworthy
Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
To validate that significant changes did not have unanticipated results

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.

Free Whitepaper: Five Best Practices for SIEM

The promise of SIEM is the consolidation of all relevant Security Event Logs from disparate sources into a single unified and normalized data store.

Simplify compliance monitoring/reporting
Vastly improve Incident Detection & Incident Response
Contextualize event information with other business relevant information

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.