The Schellman Blog

HITRUST announced in HAA 2026-005 that HITRUST CSF version 11.9 has been released. HITRUST updates the CSF at least annually or more frequently based upon changes in the security and privacy landscape. While not an entire overhaul of version 11, there are noteworthy updates, outlined below, to be aware of.

Cyber and AI risk assurance in a single examination to close the gap between traditional cyber assurance and the realities of autonomous AI. Developed in collaboration with the AICPA and AIUC and delivered by Schellman.

My kids think "quantum" is something out of a Marvel movie. And honestly, for a long time, I think a lot of the business world saw it the same way: interesting, a little unsettling, and always about ten years away.

Over the past year, I've spent a lot of time talking with AI founders, enterprise executives, CISOs, and technology leaders about the opportunities and challenges associated with artificial intelligence. There's an incredible amount of excitement about what AI can do, but there's also a growing recognition that developing powerful technology and getting enterprises comfortable deploying it are two very different things.

Data centers are the most talked-about infrastructure of the AI era. Coverage focuses on power, land, and GPUs. Far less attention goes to what lets a customer trust a facility with sensitive data: independent assurance.

I remember sitting in a Major Firms Group meeting several years ago when Barry Melancon, then CEO of the AICPA, said something that has stayed with me ever since: CPAs have always been in the trust business.

The security field is drowning in two kinds of noise.

GovRAMP (formerly StateRAMP) continues to provide useful avenues for Cloud Service Providers (CSPs) to build secure products for use by State agencies. Earlier this year, GovRAMP released a modified high baseline for CSPs to leverage in protecting the most sensitive SLED data processed by agencies.