HITRUST ASSESSMENTS
HITRUST® AI IN DETAILl
Ensure your cybersecurity program is aligned to the latest standards around use of AI
View customer success stories Take the next stepHITRUST ASSESSMENTS
HITRUST AI ASSESSMENT PROCESS
Artificial intelligence is quickly becoming embedded in core business systems, but most security and compliance programs weren’t built with AI-specific risk in mind. HITRUST now offers two AI-focused assessments that can be pursued either as standalone targeted evaluations or integrated into existing HITRUST e1, i1, or r2 assessments through MyCSF. Organizations completing an r2 (or later-version targeted assessment) can elect to include AI compliance factors directly within their broader security assessment or generate a separate targeted AI assessment focused exclusively on AI controls and mappings. This flexibility allows organizations to validate AI governance and security controls in a way that aligns with their overall compliance strategy and maturity.
AI Security Assessment
The HITRUST AI Security Assessment focuses on the technical and operational safeguards that protect AI systems and the data they process. It evaluates how organizations secure AI-enabled applications, models, training data, pipelines, and integrations within their broader information security program.
This assessment is best suited for organizations that are building, hosting, or operating AI systems, like SaaS providers, healthcare technology companies, financial services firms, and other regulated entities that need demonstrable assurance over AI-related security controls. It is particularly valuable for organizations already pursuing HITRUST e1, i1, or r2 certification that want to extend their assurance coverage to include AI-specific threats, model integrity, data protection, and secure deployment practices.
AI Risk Management Assessment
The HITRUST AI Risk Management Assessment evaluates how an organization identifies, assesses, manages, and governs AI-related risks across the enterprise. Mapped to authoritative sources such as the NIST AI Risk Management Framework and ISO AI standards, this assessment focuses on governance structures, risk evaluation processes, accountability, transparency, and oversight of AI use cases.
It is best suited for organizations that may not develop AI models themselves but deploy AI within business operations, customer-facing products, analytics platforms, or third-party solutions. This assessment is particularly useful for boards, executive leadership teams, and risk committees seeking structured validation that AI use aligns with enterprise risk tolerance, regulatory expectations, and responsible AI principles.
Frequently Asked Questions
HITRUST AI assessments can be pursued either as standalone targeted evaluations or incorporated into an existing e1, i1, or r2 assessment through MyCSF. Organizations completing an r2 assessment (v11.2 or later) can elect to include AI-specific controls as a compliance factor, or they can generate a targeted AI assessment focused exclusively on AI requirements. This allows organizations to align AI assurance with their broader security and compliance roadmap.
The AI Security Assessment focuses on the technical and operational controls that protect AI systems, models, and data. The AI Risk Management Assessment focuses on governance, oversight, and enterprise-level risk management for AI use. Organizations developing or operating AI systems often benefit from the Security Assessment, while organizations deploying AI across business functions may prioritize the Risk Management Assessment or complete both for comprehensive coverage.
HITRUST has mapped its AI controls to authoritative sources, including the NIST AI Risk Management Framework (AI RMF 1.0) and ISO AI standards, allowing organizations to demonstrate alignment to emerging regulatory and governance expectations within a single structured assessment. This reduces duplication of effort while providing measurable, reportable assurance over AI risk and security practices.
TESTIMONIALS
You Don’t Have to Take Our Word for it
“I was introduced to the team and right away there was a gel. It didn’t feel transactional. What 360 Advanced did for me was give me the confidence that I had a long-term compliance-services relationship.”
Steve Hindle
Principal Chief Security & Compliance Officer | Spirion
“We work with them on every single project, so it’s really nice to have history with 360 Advanced. They operate at a good pace – and they are friendly.”
Emma Fountinelle
Information Security Engineer | Luma Health
Learn more about HITRUST with our free guide
This guide provides organizations with a clear, concise overview of the HITRUST CSF and the associated certification process. Specifically designed for businesses navigating the complex landscape of information security and regulatory compliance.
Download the HITRUST Guide Now
Contact
Begin your HIRUST AI Journey today!
Looking for support with HITRUST AI or Risk Assessments? We’re here for you! Fill out the contact form, and within 24 hours, our team will provide the expert guidance you need.
360 Cyber News and Resources
Explore a wealth of knowledge in our client stories, insightful blogs, cutting-edge white papers, and the latest press releases—your gateway to a repository of expertise and industry insights.
