HITRUST Releases CSF Version 11.9.0 and Decommissions Versions 11.0–11.3.2: What This Means for You

HITRUST announced in HAA 2026-005 that HITRUST CSF version 11.9 has been released. HITRUST updates the CSF at least annually or more frequently based upon changes in the security and privacy landscape. While not an entire overhaul of version 11, there are noteworthy updates, outlined below, to be aware of.

What is the HITRUST CSF?

The HITRUST CSF is a security and privacy framework, comprised of and mapped to many different frameworks and regulations. HITRUST was born from the need to provide stronger assurance around HIPAA.

It has since grown to an industry and organization agnostic framework that is used by organizations within and outside the healthcare space. The framework touts consistency among control structures and provides a path to HITRUST certification.

Deadlines for HITRUST CSF Versions 11.0–11.3.2 and 11.8

If your organization currently undergoes HITRUST certification, you don’t necessarily need to jump right into version 11.9.

Note that according to HAA 2026-007, you will no longer be able to create versions 11.0–11.3.2 after December 31, 2026. However, if you already have the object created in MyCSF with one of those versions before that deadline, you can still submit for certification if the assessment is submitted by March 31, 2027.

If undergoing e1 or i1 HITRUST assessments, the same timeline applies for version 11.8). It is always best practice to evaluate the need and want to move to another version.

Noteworthy Changes in HITRUST CSF Version 11.9.0

There are a few notable changes in version 11.9.0 to highlight.

1. HITRUST added and updated new authoritative sources.
   1. Added: OWASP Top 10 for Agentic Applications, as well as a selectable factor for “Agentic AI” within the AI Security assessment.
   2. Updated: NIST SP-800-53 Rev. 5.2.0, HIPAA Privacy Rule and HIPAA Security Rule.
   3. Removed: APEC Cross-Border Privacy Rules (CBPR), Data Governance Framework, HITRUST De-ID Framework, ISO/IEC 27799:2016, ISO/IEC 29100:2011, NIST SP 800-53 r4, and The Joint Commission Cross
2. HITRUST updated the CSF Library, as well as made control (or baseline requirement statement) adjustments. While there are several adjustments, the main themes include:
   1. AI: Which should be of no surprise to anyone, given the security implication of AI. HITRUST added controls for Agentic AI factor, amongst other changes. Additionally, general updates to controls were made (not just AI controls) based upon “AI-enabled vulnerability initiatives.”
   2. Technology-specific requirements: Given how prescriptive some of the HITRUST controls are, updates on TLS and PKI, passkeys were due for some refreshing.
   3. Post-quantum cryptography: Many of the encryption controls were updated for you to consider post-quantum cryptography but not necessarily apply the changes immediately. For version 11.9.0, these are likely to be part of your risk assessment and/or implementation.

When to Move to HITRUST CSF Version 11.9.0

Now that you know the changes to HITRUST CSF version 11.9.0, you may be wondering if you should be assessed under this new version.

If your last assessment was version 11.3.2 or older, you may consider moving to version 11.9.0 because your previous version is no longer available. A newer version gives your organization a longer runway before needing to move to another version in the future.

Additionally, this move may help demonstrate your organization’s commitment to evaluating new AI and post-quantum risks.

Next Steps for HITRUST CSF Version 11.9.0

For detailed information on the CSF version 11.9.0 release, visit HITRUST’s website. If you want experts to walk you through your HITRUST journey, or to discuss reducing your audit fatigue by de-duplicating your internal compliance efforts, please reach out to us.