cyBARR Chats, HITRUST Edition Episode 12: Leveraging HITRUST MyCSF for ISO 27001 Certification

Transcript:

[00:00:00] Claire McKenna: Hello everyone. And welcome to today’s episode of cyBARR chat’s HITRUST edition. Today. We’re joined by senior high trust consultant and ISO lead auditor. Steve Ryan, to discuss how to leverage the HITRUST CSF platform to help your organization achieve other important compliance frameworks.

Namely ISO 27001. So Steve let’s get started. My first question for you. Could you just explain the differences between HITRUST and ISO requirements and why might an organization decide to pursue both

[00:00:34] Steve Ryan: absolutely clear. Thanks for having me back again. So ISO 27001 is an international standard that helps organizations establish, implement, and maintain an information security management system.

The HRIS common security framework or commonly known as a CSF is a set of prescriptive controls that cover a number of industry standards, including ISO 27,001. In fact, ISO 27001 is part of the foundation that HITRUST was built upon, which is why HRIS CSF can help satisfy the requirements of ISO. An organization might choose to pursue both for a number of reasons, such as customer requirements, increased security over their isms, as well as setting themselves up as a differentiator in the market.

These are two of the most challenging, but also most sat sought after information security certifications in organization can receive. And the fact that Hy just gives you such an upper hand in achieving both is truly a game changer. Got

[00:01:32] Claire McKenna: it. That’s great. So could you describe in a little more detail how the, my CSF platform helps with mapping security controls to ISO

[00:01:40] Steve Ryan: requirements?

Of course, an external assessor can conduct multiple audits at once. So the auditor auditor can complete all the necessary tasks and data collection processes for both HRIS and ISO at the same. If an organization has already achieved in high trust certification, it’s extremely easy to map the controls already in place to ISO, especially when the assessment data already exists and is immediately available in the, my CSF portal.

This means that all the heavy lifting is already taken care of in the organization only needs to exert a very amount, amount of effort, saving time resources, and. Awesome.

[00:02:18] Claire McKenna: So you’ve already started to touch on this a little bit, but what are some of the benefits of leveraging high trust and the, my CSF platform to achieve an ISO 27,001 certification?

[00:02:31] Steve Ryan: Yeah, so there’s a lot of value in leveraging the, my CSF tool to help achieve the N ISO certification, particularly by helping organizations avoid potential nonconformities. And as I mentioned above, save some time resources and of course, money. If there are gaps, the HRIS CSF can serve as a guide on how to mitigate those gaps and improve your overall security posture.

Your HRIS external assessor can provide guidance on how to mitigate those gaps, which is much different than the approach of ISO auditors, which can also help, avoid potential. Nonconformities. When all the information and data needed for an ISO audit is readily available in the, my CSF platform. The organization’s compliance team doesn’t need to go through redundant activities and conversations, which again, as we all know is the same enormous amount of time and resources.

[00:03:19] Claire McKenna: Awesome. Thank you. And my next question for you is how does HITRUST CSF really serve as a risk assessment framework for organizations that are gonna undergo audit assessments like ISO.

[00:03:34] Steve Ryan: Yeah. So like I mentioned order or earlier ISO orders, aren’t allowed to provide guidance on exactly how to fix issues or mitigate those gaps.

So if your organization has HITRUST in place, your external assessor can help with that expert guidance and feedback on how to close and identify gaps ahead of time there.

[00:03:52] Claire McKenna: Awesome. Well, that kind of brings me to my next question. Everything, you know, sounds great so far, but what, if any challenges are presented with leveraging CSF for ISO.

[00:04:03] Steve Ryan: Yeah. So frankly, Claire leveraging the CSF for ISO removes about 99% of the challenges it takes to achieve the ISO 27,001 certification. This again is mainly because HRIS was built off of the ISO 27,001. So inherently all the control requirements for ISO are already built in and mapped within the CSF.

That’s great.

[00:04:24] Claire McKenna: So now that we’ve, uh, discussed ISO, are there any additional compliance frameworks that you could foresee being more easily achievable with HITRUST? My CSF?

[00:04:36] Steve Ryan: Absolutely. So in addition to ISO 27,001, a high trust certification can help satisfy the requirements of other assessments, such as SOC two, PCI, FedRAMP, and many, many more.

With SOC two, for example, the a I CPA’s trust services criteria aligned with the CSF criteria, which allows us to actually issue a SOC two plus high trusts in a collaborative, uh, reporting model. That’s

[00:05:01] Claire McKenna: great. Well, that brings me to my last question, Steve, is there anything else you’d like to mention on this topic?

[00:05:08] Steve Ryan: So just last thing here, leveraging the HITRUST CSF to achieve the ISO certification is truly game changer for organizations. This allows for an audit once report on many approach, which really reduces the amount of resources organizations are required to delegate to achieving an ISO 27,001 certification.

I don’t really see any reasons why organizations that are already going through or have gone through an high trust validation. Shouldn’t also try to go through the ISO certification process as.

[00:05:38] Claire McKenna: Well, that’s great. That was my last question. So Steve, thank you so much for providing your expertise on how to leverage high trust to achieve an ISO 27001 certification.

This is certain to help some of our clients and to our audience. Thank you so much for tuning in and we look forward to seeing everyone next time on cyBARR Chats.

[00:05:57] Steve Ryan: Thanks for having me, Claire.