The HITRUST CSF is a security framework designed to help organizations—especially those in highly regulated sectors like healthcare and finance—implement industry-standard controls and manage multiple regulatory requirements simultaneously.
As the framework is comprehensive and maps numerous controls from over 50 frameworks and regulations, the HITRUST certification process can become overwhelming, especially if you approach it without adequate preparation and guidance.
To fill this knowledge gap, we have prepared an actionable nine-point HITRUST compliance checklist. Our checklist is designed to help you be audit-ready for HITRUST without overstretching your security teams.
Before we begin, let’s take a quick look at the basics.
HITRUST CSF at a glance
The HITRUST CSF is a prescriptive framework that maps controls and best practices of over 50 standards and regulations, including HIPAA, GDPR, and PCI-DSS. The idea behind this framework is to make it easier for organizations to:
- Achieve their compliance journey efficiently
- Access robust security and risk management practices
- Demonstrate their security and compliance efforts to stakeholders
Obtaining a HITRUST certificate entails evaluating your existing controls and meeting any deficiencies before a formal external audit. The complexity of the overall process can depend on your chosen certification level—outlined below:
Regardless of the chosen certification level, your controls must be in line with HITRUST’s 19 control domains:
- Information Protection Program
- Endpoint Protection
- Portable Media Security
- Mobile Device Security
- Wireless Security
- Configuration Management
- Vulnerability Management
- Network Protection
- Transmission Protection
- Password Management
- Access Control
- Audit Logging & Monitoring
- Education, Training and Awareness
- Third Party Assurance
- Incident Management
- Business Continuity & Disaster Recovery
- Risk Management
- Physical & Environmental Security
- Data Protection & Privacy
Each control domain comes with a set of requirement statements that you must meet to obtain a certificate.
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
Who needs HITRUST compliance?
HITRUST was initially designed exclusively for healthcare organizations. However, since the framework’s introduction in 2007, it has been updated multiple times to ensure applicability to other industries, including technology, insurance and finance, and government sectors. The cross-industry applicability is mainly due to the framework’s scalable and customizable format.
From a regulatory standpoint, becoming HITRUST-certified streamlines scattered compliance tasks for organizations that collect, store, or process sensitive data. Such organizations include the following:
- Healthcare providers
- Insurance companies
- Healthcare clearinghouses
Still, any organization that wants to improve and demonstrate its security posture can leverage HITRUST. Here are the benefits to expect:
- Evolving cybersecurity: As a threat-adaptive framework, HITRUST CSF continuously evolves to help organizations shield themselves from the latest cybersecurity threats
- Efficient risk management and mitigation: The framework includes many controls that help you build a more resilient risk management program
- Competitive advantage: Potential customers, investors, and other stakeholders consider HITRUST certification as proof of advanced security, which enhances your organization's trustworthiness and marketability
A 9-step HITRUST certification checklist
Here’s a broad overview of steps that organizations looking to get HITRUST-compliant can follow:
- Review your security and compliance posture
- Find an external assessor
- Scope your HITRUST assessment
- Perform a readiness assessment
- Perform remediation and evidence collection
- Score your controls
- Submit the self-assessment for validation
- Complete the QA process
- Review the certification report
We’ll discuss what each step entails below.
1. Review your security and compliance posture
Before starting the HITRUST certification process, you must outline your organization’s security standing, growth goals, and compliance requirements. Doing so will make it easier to arrive at several decisions regarding certification, such as:
- The right HTRUST certification level
- Scope of the assessment
- The controls you need to optimize or add
Start by conducting a comprehensive security review. Assess your current IT infrastructure and document the existence and effectiveness of the relevant controls. You should then conduct an internal compliance audit to understand your posture and make it easier to identify gaps later on.
Note: Creating your company’s MyCSF account will be a non-negotiable task before starting your HITRUST compliance journey. MyCSF is HITRUST’s cloud-based compliance platform with built-in forms and functionalities to help you map your controls and complete all admin tasks related to certification.
{{cta_webinar3="/cta-modules"}} | Choosing the right HITRUST certification level and streamlining implementation
2. Find an external assessor
HITRUST certification requires a self-assessment, which is further validated by an external assessor—an individual practitioner or organization authorized by HITRUST to perform validated assessments and review your controls against the framework’s requirements.
Although you can complete this step later, it’s ideal to find a reputable HITRUST assessor early on in the compliance process. The assessor’s niche expertise can help organizations identify and remediate gaps before the official audit, as well as align with certification timelines and expectations.
Some of the key tasks an external assessor performs during the validation procedure include:
- Reviews of written policies and their implementation
- Personnel interviews
- Inspection of the provided evidence validating your controls
3. Scope your HITRUST assessment
Assessment scoping is a considerable challenge in the HITRUST certification process, especially if you choose one of the higher assessment levels that can have 100+ controls. That’s why you must clearly outline the systems, devices, and other components of your security infrastructure that the assessment will cover.
Assessment scoping depends on many factors, such as:
- Your organization’s available resources and personnel
- Desired security program maturity
- The nature, amount, and flow of sensitive data
- The type of new clients or markets you want to access
To make scoping easier, HITRUST suggests several approaches you can take, some of which are discussed in the following table:
4. Perform a readiness assessment
A readiness assessment involves a gap analysis that helps you compare your controls to HITRUST’s requirements. While not a mandatory step of the certification process, it's highly beneficial for ensuring your controls meet the necessary standards, considerably reducing the time and effort you spend on a validated assessment.
Unlike validated assessments, readiness assessments aren’t reviewed by HITRUST or performed by an external assessor. Instead, you can designate an internal assessor/team to conduct the assessment or hire a third party. The choice is yours as long as the assessor is approved by HITRUST. The appropriate option typically depends on your internal expertise and budget, as well as how well-prepared you wish to be.
5. Perform remediation and evidence collection
In many cases, a readiness assessment may uncover compliance gaps that need to be remediated before you request a validated assessment. While it’s technically possible to enter a validated assessment without bridging the gaps, it’s not the ideal course of action as doing so exposes you to considerable back-and-forth during validation.
This is why you’ll want to leverage the results of your readiness assessment to include, change, or improve in-scope controls so that they’re aligned with HITRUST requirements.
As you work to optimize your controls, make sure to collect all the evidence that validates their existence and performance—the external assessor will use it later to verify your self-assessment.
Common types of evidence include the following:
- Written
- Verbal
- Observed
- Digital
Collecting all this evidence manually can be laborious and time-consuming, especially if you have a complex IT infrastructure. Ideally, you’ll automate the process using a compliance automation platform to remove painstaking work and expedite the assessment.
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
6. Score your controls
The HITRUST audit requires the scoring of your in-scope controls to ensure they reach the prescribed threshold. Scoring is performed using HITRUST’s Control Maturity Scoring Rubric—a visual tool designed to help organizations grade controls according to the PRISMA model, an acronym for Product RISk MAnagement.
PRISMA dictates five factors for assessing the maturity of controls:
- Are your policies in place?
- Do you have documents to support your procedures?
- Are processes implemented well?
- What monitoring and measurement practices are in place?
- What corrective or continuous improvement actions are being taken?
If you opt for an e1 or i1 assessment, you only need to score the implementation level (#3) of your controls. For r2 assessments, you must score all five levels.
From a process perspective, scoring a control comes down to determining its strength and coverage. The goal is to place the control in the rubric and assign a corresponding score.
7. Submit the self-assessment for validation
After your self-assessment is completed, you’ll submit it for validation through HITRUST’s MyCSF portal. The portal makes it easier to complete all critical phases of the assessment process by unifying all the requirements and correction plans in one place.
During validation, your external assessor will examine each in-scope control to assess the validity of its score. They’ll go through your compiled evidence to provide any feedback or action items.
If you receive such feedback, you might need to review some controls to realign them with the prescribed requirements. This step can be iterative, and its success hinges on how smoothly you collaborate with your external assessor.
8. Complete the QA process
After an external assessor has completed the validation process, your assessment must undergo quality assurance. HITRUST’s QA analyst performs this process, conducting the final review of your controls and ensuring that all assessment guidelines have been followed.
In some cases, the analyst might assign tasks, which can be:
- General tasks: Instructions or requests to be completed to remediate a QA concern
- Proposed tasks: An advised change that must be considered for the QA process to be successful
Tasks are assigned to the external assessor by default, but they might still contact you to help resolve an issue. After the relevant tasks have been addressed, the QA analyst will approve the assessment.
9. Review the certification report
If your HITRUST certification is successful, you’ll receive a draft report that confirms you’ve passed the assessment. Once you obtain it, you have 30 days to review the report and request revisions if needed.
When you submit the report for revisions, your assessment will go into the Revisit Draft phase. After HITRUST has made any necessary changes, you’ll get the draft back for approval. If the draft is approved, you’ll receive the final report.
{{cta_testimonial11="/cta-modules"}} | US Med-Equip Customer Story
Vanta: Your one-stop solution for HITRUST compliance
To obtain a HITRUST certificate quickly and effortlessly, you should support the certification process with the right software—that's where Vanta comes in.
Vanta is an end-to-end trust management platform that automates up the HITRUST CSF certification process. From providing ready-made workflows to policy templates and tests, the platform can streamline your entire compliance journey.
As HITRUST’s official automation partner, Vanta offers a scalable HITRUST CSF product equipped with numerous features that fast-track certification tasks. Your team can leverage Vanta for:
- Streamlined evidence collection supported by over 375 integrations
- Automated gap analysis and cross-referencing of your controls with major standards and regulations (HIPAA, SOC 2, etc.)
- Centralized tracking and documentation of the HITRUST certification process
- Evidence upload to MyCSF with a custom integration
If you need an experienced external assessor, you can tap into Vanta’s extensive partner network to discover industry-leading organizations that can support your compliance goals.
Schedule a Vanta demo for your team to get tailored insights on how the platform can support successful security and compliance outcomes.
{{cta_simple16="/cta-modules"}} | HITRUST product page
HITRUST requirements
The essential HITRUST certification checklist
HITRUST requirements
The HITRUST CSF is a security framework designed to help organizations—especially those in highly regulated sectors like healthcare and finance—implement industry-standard controls and manage multiple regulatory requirements simultaneously.
As the framework is comprehensive and maps numerous controls from over 50 frameworks and regulations, the HITRUST certification process can become overwhelming, especially if you approach it without adequate preparation and guidance.
To fill this knowledge gap, we have prepared an actionable nine-point HITRUST compliance checklist. Our checklist is designed to help you be audit-ready for HITRUST without overstretching your security teams.
Before we begin, let’s take a quick look at the basics.
HITRUST CSF at a glance
The HITRUST CSF is a prescriptive framework that maps controls and best practices of over 50 standards and regulations, including HIPAA, GDPR, and PCI-DSS. The idea behind this framework is to make it easier for organizations to:
- Achieve their compliance journey efficiently
- Access robust security and risk management practices
- Demonstrate their security and compliance efforts to stakeholders
Obtaining a HITRUST certificate entails evaluating your existing controls and meeting any deficiencies before a formal external audit. The complexity of the overall process can depend on your chosen certification level—outlined below:
Regardless of the chosen certification level, your controls must be in line with HITRUST’s 19 control domains:
- Information Protection Program
- Endpoint Protection
- Portable Media Security
- Mobile Device Security
- Wireless Security
- Configuration Management
- Vulnerability Management
- Network Protection
- Transmission Protection
- Password Management
- Access Control
- Audit Logging & Monitoring
- Education, Training and Awareness
- Third Party Assurance
- Incident Management
- Business Continuity & Disaster Recovery
- Risk Management
- Physical & Environmental Security
- Data Protection & Privacy
Each control domain comes with a set of requirement statements that you must meet to obtain a certificate.
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
Who needs HITRUST compliance?
HITRUST was initially designed exclusively for healthcare organizations. However, since the framework’s introduction in 2007, it has been updated multiple times to ensure applicability to other industries, including technology, insurance and finance, and government sectors. The cross-industry applicability is mainly due to the framework’s scalable and customizable format.
From a regulatory standpoint, becoming HITRUST-certified streamlines scattered compliance tasks for organizations that collect, store, or process sensitive data. Such organizations include the following:
- Healthcare providers
- Insurance companies
- Healthcare clearinghouses
Still, any organization that wants to improve and demonstrate its security posture can leverage HITRUST. Here are the benefits to expect:
- Evolving cybersecurity: As a threat-adaptive framework, HITRUST CSF continuously evolves to help organizations shield themselves from the latest cybersecurity threats
- Efficient risk management and mitigation: The framework includes many controls that help you build a more resilient risk management program
- Competitive advantage: Potential customers, investors, and other stakeholders consider HITRUST certification as proof of advanced security, which enhances your organization's trustworthiness and marketability
A 9-step HITRUST certification checklist
Here’s a broad overview of steps that organizations looking to get HITRUST-compliant can follow:
- Review your security and compliance posture
- Find an external assessor
- Scope your HITRUST assessment
- Perform a readiness assessment
- Perform remediation and evidence collection
- Score your controls
- Submit the self-assessment for validation
- Complete the QA process
- Review the certification report
We’ll discuss what each step entails below.
1. Review your security and compliance posture
Before starting the HITRUST certification process, you must outline your organization’s security standing, growth goals, and compliance requirements. Doing so will make it easier to arrive at several decisions regarding certification, such as:
- The right HTRUST certification level
- Scope of the assessment
- The controls you need to optimize or add
Start by conducting a comprehensive security review. Assess your current IT infrastructure and document the existence and effectiveness of the relevant controls. You should then conduct an internal compliance audit to understand your posture and make it easier to identify gaps later on.
Note: Creating your company’s MyCSF account will be a non-negotiable task before starting your HITRUST compliance journey. MyCSF is HITRUST’s cloud-based compliance platform with built-in forms and functionalities to help you map your controls and complete all admin tasks related to certification.
{{cta_webinar3="/cta-modules"}} | Choosing the right HITRUST certification level and streamlining implementation
2. Find an external assessor
HITRUST certification requires a self-assessment, which is further validated by an external assessor—an individual practitioner or organization authorized by HITRUST to perform validated assessments and review your controls against the framework’s requirements.
Although you can complete this step later, it’s ideal to find a reputable HITRUST assessor early on in the compliance process. The assessor’s niche expertise can help organizations identify and remediate gaps before the official audit, as well as align with certification timelines and expectations.
Some of the key tasks an external assessor performs during the validation procedure include:
- Reviews of written policies and their implementation
- Personnel interviews
- Inspection of the provided evidence validating your controls
3. Scope your HITRUST assessment
Assessment scoping is a considerable challenge in the HITRUST certification process, especially if you choose one of the higher assessment levels that can have 100+ controls. That’s why you must clearly outline the systems, devices, and other components of your security infrastructure that the assessment will cover.
Assessment scoping depends on many factors, such as:
- Your organization’s available resources and personnel
- Desired security program maturity
- The nature, amount, and flow of sensitive data
- The type of new clients or markets you want to access
To make scoping easier, HITRUST suggests several approaches you can take, some of which are discussed in the following table:
4. Perform a readiness assessment
A readiness assessment involves a gap analysis that helps you compare your controls to HITRUST’s requirements. While not a mandatory step of the certification process, it's highly beneficial for ensuring your controls meet the necessary standards, considerably reducing the time and effort you spend on a validated assessment.
Unlike validated assessments, readiness assessments aren’t reviewed by HITRUST or performed by an external assessor. Instead, you can designate an internal assessor/team to conduct the assessment or hire a third party. The choice is yours as long as the assessor is approved by HITRUST. The appropriate option typically depends on your internal expertise and budget, as well as how well-prepared you wish to be.
5. Perform remediation and evidence collection
In many cases, a readiness assessment may uncover compliance gaps that need to be remediated before you request a validated assessment. While it’s technically possible to enter a validated assessment without bridging the gaps, it’s not the ideal course of action as doing so exposes you to considerable back-and-forth during validation.
This is why you’ll want to leverage the results of your readiness assessment to include, change, or improve in-scope controls so that they’re aligned with HITRUST requirements.
As you work to optimize your controls, make sure to collect all the evidence that validates their existence and performance—the external assessor will use it later to verify your self-assessment.
Common types of evidence include the following:
- Written
- Verbal
- Observed
- Digital
Collecting all this evidence manually can be laborious and time-consuming, especially if you have a complex IT infrastructure. Ideally, you’ll automate the process using a compliance automation platform to remove painstaking work and expedite the assessment.
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
6. Score your controls
The HITRUST audit requires the scoring of your in-scope controls to ensure they reach the prescribed threshold. Scoring is performed using HITRUST’s Control Maturity Scoring Rubric—a visual tool designed to help organizations grade controls according to the PRISMA model, an acronym for Product RISk MAnagement.
PRISMA dictates five factors for assessing the maturity of controls:
- Are your policies in place?
- Do you have documents to support your procedures?
- Are processes implemented well?
- What monitoring and measurement practices are in place?
- What corrective or continuous improvement actions are being taken?
If you opt for an e1 or i1 assessment, you only need to score the implementation level (#3) of your controls. For r2 assessments, you must score all five levels.
From a process perspective, scoring a control comes down to determining its strength and coverage. The goal is to place the control in the rubric and assign a corresponding score.
7. Submit the self-assessment for validation
After your self-assessment is completed, you’ll submit it for validation through HITRUST’s MyCSF portal. The portal makes it easier to complete all critical phases of the assessment process by unifying all the requirements and correction plans in one place.
During validation, your external assessor will examine each in-scope control to assess the validity of its score. They’ll go through your compiled evidence to provide any feedback or action items.
If you receive such feedback, you might need to review some controls to realign them with the prescribed requirements. This step can be iterative, and its success hinges on how smoothly you collaborate with your external assessor.
8. Complete the QA process
After an external assessor has completed the validation process, your assessment must undergo quality assurance. HITRUST’s QA analyst performs this process, conducting the final review of your controls and ensuring that all assessment guidelines have been followed.
In some cases, the analyst might assign tasks, which can be:
- General tasks: Instructions or requests to be completed to remediate a QA concern
- Proposed tasks: An advised change that must be considered for the QA process to be successful
Tasks are assigned to the external assessor by default, but they might still contact you to help resolve an issue. After the relevant tasks have been addressed, the QA analyst will approve the assessment.
9. Review the certification report
If your HITRUST certification is successful, you’ll receive a draft report that confirms you’ve passed the assessment. Once you obtain it, you have 30 days to review the report and request revisions if needed.
When you submit the report for revisions, your assessment will go into the Revisit Draft phase. After HITRUST has made any necessary changes, you’ll get the draft back for approval. If the draft is approved, you’ll receive the final report.
{{cta_testimonial11="/cta-modules"}} | US Med-Equip Customer Story
Vanta: Your one-stop solution for HITRUST compliance
To obtain a HITRUST certificate quickly and effortlessly, you should support the certification process with the right software—that's where Vanta comes in.
Vanta is an end-to-end trust management platform that automates up the HITRUST CSF certification process. From providing ready-made workflows to policy templates and tests, the platform can streamline your entire compliance journey.
As HITRUST’s official automation partner, Vanta offers a scalable HITRUST CSF product equipped with numerous features that fast-track certification tasks. Your team can leverage Vanta for:
- Streamlined evidence collection supported by over 375 integrations
- Automated gap analysis and cross-referencing of your controls with major standards and regulations (HIPAA, SOC 2, etc.)
- Centralized tracking and documentation of the HITRUST certification process
- Evidence upload to MyCSF with a custom integration
If you need an experienced external assessor, you can tap into Vanta’s extensive partner network to discover industry-leading organizations that can support your compliance goals.
Schedule a Vanta demo for your team to get tailored insights on how the platform can support successful security and compliance outcomes.
{{cta_simple16="/cta-modules"}} | HITRUST product page
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
| Role: | GRC responsibilities: |
|---|---|
| Board of directors | Central to the overarching GRC strategy, this group sets the direction for the compliance strategy. They determine which standards and regulations are necessary for compliance and align the GRC strategy with business objectives. |
| Chief financial officer | Primary responsibility for the success of the GRC program and for reporting results to the board. |
| Operations managers from relevant departments | This group owns processes. They are responsible for the success and direction of risk management and compliance within their departments. |
| Representatives from relevant departments | These are the activity owners. These team members are responsible for carrying out specific compliance and risk management tasks within their departments and for integrating these tasks into their workflows. |
| Contract managers from relevant department | These team members are responsible for managing interactions with vendors and other third parties in their department to ensure all risk management and compliance measures are being taken. |
| Chief information security officer (CISO) | Defines the organization’s information security policy, designs risk and vulnerability assessments, and develops information security policies. |
| Data protection officer (DPO) or legal counsel | Develops goals for data privacy based on legal regulations and other compliance needs, designs and implements privacy policies and practices, and assesses these practices for effectiveness. |
| GRC lead | Responsible for overseeing the execution of the GRC program in collaboration with the executive team as well as maintaining the organization’s library of security controls. |
| Cybersecurity analyst(s) | Implements and monitors cybersecurity measures that are in line with the GRC program and business objectives. |
| Compliance analyst(s) | Monitors the organization’s compliance with all regulations and standards necessary, identifies any compliance gaps, and works to mitigate them. |
| Risk analyst(s) | Carries out the risk management program for the organization and serves as a resource for risk management across various departments, including identifying, mitigating, and monitoring risks. |
| IT security specialist(s) | Implements security controls within the IT system in coordination with the cybersecurity analyst(s). |
