CAP decisions are made at theControl Reference level, not both Requirement Statement and Control Reference levels. Individual requirement statements roll up into a control reference, and the control reference score determines whether a CAP is required. For instance, a low-scoring requirement may be present, but if the aggregated control reference score remains above the threshold, a CAP may not be required. Conversely, if the control reference score falls below the defined threshold, then a CAP is mandatory. This approach ensures consistency by focusing on control objectives as a whole rather than single requirements. Therefore, CAP decisions are not made independently at the requirement statement level, making the statementFalse.
References:HITRUST CSF Scoring Rubric - "Control Reference Scoring and CAP Triggers"; CCSFP Practitioner Guide - "CAPs at the Control Reference Level."