Free HITRUST CCSFP Practice Exam with Questions & Answers | Set: 4

In an i1 assessment, scoring follows a pass/fail logic tied to CAP requirements. If a Control Reference scores below the defined threshold (typically 83 for i1 assessments), any gaps within its requirement statements must be addressed with a required Corrective Action Plan (CAP). A score of 62 is below the threshold, meaning it cannot be accepted without remediation. This ensures organizations remediate key cybersecurity hygiene gaps, even in a moderate assurance assessment. Optional CAPs are not used in i1 assessments, as the assurance program emphasizes mandatory remediation for below-threshold controls. Certification cannot be granted with unresolved required CAPs. Therefore, the correct outcome for a score of 62 in an i1 Control Reference is a required CAP.

Regulatory factors are a mandatory part of the scoping process in r2 assessments. These factors represent applicable laws, regulations, or frameworks that impact the organization’s operations. Examples include HIPAA, PCI-DSS, GDPR, state data protection laws, CMS Minimum Security Requirements, and FedRAMP. When a regulatory factor is selected in MyCSF, additional requirement statements are automatically generated within the assessment object. These statements tailor the control environment to match external obligations, ensuring alignment with compliance expectations.

For example, selecting PCI-DSS will add specific controls related to cardholder data protection. Selecting HIPAA will add requirements for safeguarding protected health information. Without selecting these factors, the assessment would not provide complete coverage, and certification would lack credibility. This dynamic tailoring is one of the strengths of HITRUST’s risk-based approach, ensuring each entity’s assessment is relevant to its regulatory landscape.

HITRUST defines sample sizes for manual controls based on the frequency of operation. For controls that operate weekly, the required sample size is 5 items. This ensures that the assessor can evaluate consistency over multiple weeks without excessive burden. For example, if access logs are reviewed weekly, five weeks of logs must be tested. A higher frequency (e.g., daily controls) requires larger samples, such as 25. Conversely, less frequent controls (e.g., monthly or quarterly) may only require 2 or 1 sample. The structured sampling methodology provides consistency across assessments, ensures sufficient evidence for scoring, and prevents under-testing of critical controls.

The A1 Security Assessment factor is an optional module that introduces requirements for evaluating the security and governance of AI-based systems. These requirements are mapped into HITRUST CSF across domains like risk management, monitoring, and governance. Importantly, the A1 factor is not restricted solely to r2 assessments. While r2 provides the most comprehensive assurance model, A1 can also be added to other eligible assessment types such as i1 when the scope involves AI risks. The factor is treated like any other regulatory or organizational factor in MyCSF—its selection generates additional tailored requirement statements. Therefore, the claim that A1 can only be added to r2 is inaccurate. The correct understanding is that A1 can apply to multiple assessment types, depending on scoping decisions.

The scoring model in HITRUST is hierarchical. Each Requirement Statement is scored individually across maturity levels (Policy, Procedure, Implemented, Measured, Managed). These scores roll up into Control References, which represent collections of related requirement statements. The average of Control References within a domain determines the Domain Score. Finally, domain scores are used to evaluate whether certification thresholds are met (e.g., minimum domain score of 71 for r2 certification). This hierarchical averaging ensures that deficiencies in individual requirements are reflected in higher-level scores, promoting balance across all controls within a domain.

The Offline Assessment function is initiated within the assessment object in MyCSF. This feature allows assessors to export requirement statements into an Excel spreadsheet format, which can then be used offline to collect responses, notes, and preliminary evidence. Once populated, the spreadsheet can be uploaded back into MyCSF to synchronize with the online assessment object. This capability is particularly useful when assessors or clients must work in environments with limited internet access or when they prefer batch updates. It is not launched from the landing page, analytics, or via the support desk; it is always tied directly to a specific assessment object.

HITRUST certification for an r2 assessment requires that all 19 domains achieve a minimum average score of 71 or higher. Certification is not based on every individual requirement statement being perfect, but on whether each domain score meets the threshold.

Looking at the Data Protection & Privacy domain in the table:

Current scores: 42 (Privacy Officer), 63 (Formal Privacy Program), 68 (Senior Management), and 70 (Requests for covered…).

These average to 60.75, which is below the 71 threshold.

If the “Privacy Officer” requirement score increases from 42 → 50, the recalculated domain average becomes:

(50 + 63 + 68 + 70) ÷ 4 = 62.75.

Now consider the rest of the chart: Information Program scores are in the 70s and 80s, Endpoint Protection is 62 and 79, Wireless Protection is 84. With the Privacy Officer improved to 50, the Data Protection & Privacy domain average rises closer to the certification threshold. Since HITRUST considers domain averages, not just one control, this improvement pushes the domain to an acceptable score when balanced against all other domains.

Thus, yes — the organization would achieve certification with this change, making the correct answer True.

The Measured maturity level evaluates whether organizations actively monitor the effectiveness of controls. HITRUST defines seven criteria for Measured, including metrics, data collection, analysis, reporting, and corrective action tracking. If these seven criteria are fully met, scoring can begin at Tier 4 strength, reflecting a mature measurement process. In the example, system administrators are responsible for measuring firewall configuration security, and if they meet all seven criteria (such as reviewing firewall rules, analyzing logs, reporting deviations, and initiating remediation), the Measured compliance level can start at Tier 4. The assessor may then adjust scoring based on coverage and frequency, but the baseline is Tier 4 once all criteria are satisfied. This ensures consistent evaluation of advanced maturity levels across controls.

The A1 Security Assessment module evaluates the security, governance, and risk management of artificial intelligence models. HITRUST specifies coverage for widely used model types, including:

Predictive models, which forecast outcomes based on historical data (e.g., fraud detection, patient risk scoring).

Generative models, which create new data outputs (e.g., AI image or text generators).

Rule-based models, which use defined logic for decision-making.

The goal of the A1 assessment is to ensure that these AI models are developed, implemented, and monitored securely, with appropriate safeguards around data integrity, bias management, and model explainability. Options like Hodgkin-Huxley (a neuroscience model) and Back Propagation (a training algorithm) are not types of AI models scoped by the A1 assessment. Instead, the A1 factor focuses on applied model categories used in operational environments.

When testing implementation, the population must include the full set of in-scope assets, not just a subset filtered by existing controls.

AV console (A) → only shows devices with AV installed; it would exclude noncompliant assets.

IT asset inventory (C) → provides the complete list of laptops, making it the proper source for random sample selection.

Risk register (D) → lists risks, not devices.

Capital assets only (B) → not comprehensive for all laptops.

Extract Reference (HITRUST Assessment Sampling Guidance, CCSFP [0173]):

Sampling must be based on the complete population from the IT asset inventory; reliance on control-based systems (e.g., AV console) introduces bias.