HITRUST enforces strict evidence requirements to maintain credibility of assessment results. ForPolicy and Procedurematurity levels, if a score above 25% is claimed, the organization must link appropriate evidence (e.g., documented policies, standard operating procedures). ForImplementation, Measured, and Managed, evidence must be provided whenever a score greater than 0% is claimed. This ensures that claims are supported by objective artifacts rather than assertions. Evidence can include policy documents, monitoring reports, logs, meeting minutes, or audit records. HITRUST QA verifies that evidence is linked to requirement statements at each maturity level. Without linked evidence, scores may be reduced or reverted during QA.
This policy ensures transparency, accountability, and prevents overstatement of control effectiveness.
References:HITRUST CSF Assurance Program - "Evidence Linking Requirements"; CCSFP Practitioner Guide - "Evidence Thresholds by Maturity Level."