The HITRUST Common Security Framework (CSF) is a comprehensive set of requirements that helps your organization implement industry-standard security measures. Primarily used to support the healthcare industry, a HITRUST certification enables organizations to comply with HIPAA and over 50 other standards and regulations. This makes it an ideal solution for organizations in security-conscious industries.
Due to the framework’s extensive coverage and multi-step certification process, it’s best to have a good understanding of the main HITRUST requirements around implementing security controls, evidence collection, and other procedural aspects. This article will provide you with the directional guidance you need by covering the following:
- A breakdown of HITRUST certification requirements
- Different scoring requirements for HITRUST assessment levels
- Actionable tips for meeting HITRUST requirements effortlessly
HITRUST certification: At a glance
HITRUST certification entails adhering to the HITRUST CSF requirements which demonstrates your organization's security and privacy posture. The certification process involves a comprehensive self-assessment, which is validated by an external assessor and then reviewed by a QA analyst from HITRUST.
Prerequisites for HITRUST certification
Before pursuing your HITRUST certification, you must define your assessment scope, which depends on the certification or assessment level you want. Currently, you can choose one of the following levels:
- e1: The base-level assessment covers 44 critical controls that every organization should implement to ensure adequate security and privacy. This certification level is best suited for small organizations with simple IT infrastructures.
- i1: A more robust assessment including 180+ controls. The i1 assessment provides greater assurance and is mainly aimed at mid-sized organizations and those that want to use it as an onramp for r2 certification.
- r2: A risk-based assessment with custom controls (out of 2,000+ in total). The r2 certificate is best suited for large organizations with complex risk landscapes and IT infrastructures because it provides the highest level of assurance.
For many organizations, choosing a HITRUST tier depends on their security and compliance landscape, as well as their growth goals, such as accessing new markets or building trust with high-value clients. Your chosen tier will determine the breadth of requirements you need to meet.
Another prerequisite is obtaining access to the HITRUST MyCSF portal before you start the self-assessment. It’s a cloud-based platform that enables all procedural elements of the certification process, such as completing risk analysis and submitting assessments.
Here’s an overview of the key procedural aspects of HITRUST certification:
- Determining assessment scope
- Obtaining access to the MyCSF portal
- Implement HITRUST controls
- Performing a gap assessment and score your control implementation
- Validation of controls by a HITRUST assessor
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
A breakdown of HITRUST certification requirements
We’ll present a general outline of the main HITRUST certification requirements covered across four sections:
- What HITRUST control domains should you cover?
- What are HITRUST scoring thresholds?
- How is HITRUST scoring performed?
- How should you report on implemented controls?
1. What HITRUST security domains should you cover?
One of the reasons why HITRUST certification is beneficial is the breadth of control coverage. The framework prescribes controls across 19 security domains, such as:
- Information Protection Program
- Access Control
- Risk Management
- Transmission Protection
- Incident Management
- Business Continuity & Disaster Recovery
While the required controls are already mapped out for e1 and i1, you must work with your security team to scope controls for r2.
2. What are HITRUST scoring thresholds?
To obtain a certificate, each control domain must reach the prescribed score. The threshold depends on the certification level:
- e1/i1: 83 or higher
- r2: 62 or higher
Under each control domain, you’ll score specific requirement statements, so domain scores are expressed as the average score of all requirement statements under that domain.
You might encounter different scoring scenarios, explained below:
3. How is HITRUST scoring performed?
HITRUST scoring involves the evaluation and scoring of in-scope requirement statements. Once you’ve scored each requirement statement, you add up the scores and divide them by the number of requirements within a domain to get the average domain score, which needs to meet the thresholds discussed above.
To score each requirement statement, you’ll use HITRUST’s Control Maturity Scoring Rubric. It’s a visual tool in the form of a matrix that scores HITRUST requirements according to the PRISMA model. The rubric has five maturity levels:
- Policy
- Procedure
- Implemented
- Measured
- Managed
Note: For e1 and i1 assessments, you only need to evaluate the Implemented level.
4. How should you report on implemented controls?
The framework requires you to report on the controls via MyCSF—HITRUST’s cloud-based SaaS solution to facilitate audits and assessments. The first step is to carry out a self-assessment of your implemented controls and domain scores. Once completed, it’s reviewed by a HITRUST-approved external assessor, who will look for evidence that each requirement statement’s score is valid. Such evidence can be:
- Verbal
- Observed
- Written
- Digital
If your scores are valid, a HITRUST QA analyst will perform a final review to ensure the overall guidelines were met. Once the process is successful, you’ll obtain a certificate corresponding to your selected assessment level.
{{cta_webinar3="/cta-modules"}} | Choosing the right HITRUST certification level and streamlining implementation
3 expert tips for meeting HITRUST certification requirements
A HITRUST assessment can take a considerable amount of time if performed manually or without guidance. Follow these tips to avoid common pitfalls and expedite the process:
- Consider scoping the assessment thoroughly
- Try to perform a readiness assessment beforehand
- Automate the certification process
1. Consider scoping the assessment thoroughly
If you have a maturing security program or are pursuing r2 certification, assessment scoping can be a considerable challenge. You need to outline all the business units, systems, and devices that will be scrutinized under the assessment.
For precise scoping, consider the following factors:
- Needs of your relying parties
- Maturity level of your existing security system
- Expected short-term changes to your IT infrastructure
Another option is to take several approaches to scoping, such as:
- Enterprise-level: All your platforms, networks, and supported infrastructure are considered for the assessment.
- IT service or platform-focused: A select few networks or components of your infrastructure are scoped. You can take this approach if you’re looking to meet specific regulatory or contractual obligations or want to use the assessment as a building block to facilitate organization-wide HITRUST compliance down the line.
- Follow-the-data: The assessment will encompass platforms and infrastructure impacted by the flow of specific data you wish to safeguard. This approach can be used if you handle sensitive data that requires a higher level of protection.
2. Try to perform a readiness assessment beforehand
A readiness assessment is used to identify and bridge any gaps in your in-scope controls. Unlike a validated HITRUST assessment that is mandatory for certification purposes, a readiness assessment is optional and used purely for internal reference.
By performing a readiness assessment, you can simulate the validated assessment process to understand all your HITRUST requirements and scoring workflows. This can bring benefits such as:
- A streamlined and faster certification process
- Increased confidence among stakeholders
- Proactive addressing of gaps in security posture and program maturity
A readiness assessment is also an excellent way to save resources on reassessments and last-minute security reviews down the line, which can be costly and prolong the certification process.
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
3. Automate the certification process
The validation process before certification requires you to present extensive evidence to the external assessor to prove your controls meet HITRUST’s certification requirements. Collecting such evidence can demand considerable time and resources, especially if you have a broad audit scope.
Ideally, you can remove most of the manual work from your security review and evidence collection processes through automation. You can do this in several ways, such as:
- Assessing your CSP’s controls: HITRUST uses the shared responsibility model, so you can inherit the controls established by your cloud service provider (CSP) and improve efficiency.
- Centralizing your security and compliance data: Disparate systems and data sources can slow down evidence collection. Use integrations to keep all relevant data in one accessible hub and provide the necessary proof without painstaking busy work.
- Leveraging an automation solution: HITRUST framework mapped into software helps you meet all the necessary requirements with minimal work. For instance, Vanta is one compliance automation tool that comes with HITRUST-adjusted automation features.
Get HITRUST-certified faster with Vanta
If you want to obtain a HITRUST certificate quickly and seamlessly, Vanta can be the perfect solution. It’s a trust management platform that automates up to 80% of the HITRUST certification requirements.
Vanta is the first and currently the only automaton platform with ready-made e1/i1 and r2 frameworks vetted by HITRUST. With Vanta, you get all the guidance you need to prevent unpleasant surprises during the certification process. You can use the platform to perform a readiness assessment quickly so that all your controls are ready for the validated assessment.
Watch this free webinar to explore Vanta’s HITRUST CSF product and its automation features. Some efficiency-boosting functionalities of the solution include:
- Automated evidence collection powered by 350+ integrations
- Centralized tracking of HITRUST requirements
- Automated gap assessments
- Cross-mapping controls with other supported frameworks (like HIPAA and SOC 2) to avoid duplicative work
- Built-in resources like policy templates and tests
- Integration with HITRUST MyCSF
You can request a demo to get a hands-on overview of these features.
Vanta also offers a vetted service partner network where you can find expert HITRUST assessors to see you through the certification process.
{{cta_simple16="/cta-modules"}} | HITRUST product page
HITRUST requirements
What are the essential requirements of HITRUST certification?
HITRUST requirements
The HITRUST Common Security Framework (CSF) is a comprehensive set of requirements that helps your organization implement industry-standard security measures. Primarily used to support the healthcare industry, a HITRUST certification enables organizations to comply with HIPAA and over 50 other standards and regulations. This makes it an ideal solution for organizations in security-conscious industries.
Due to the framework’s extensive coverage and multi-step certification process, it’s best to have a good understanding of the main HITRUST requirements around implementing security controls, evidence collection, and other procedural aspects. This article will provide you with the directional guidance you need by covering the following:
- A breakdown of HITRUST certification requirements
- Different scoring requirements for HITRUST assessment levels
- Actionable tips for meeting HITRUST requirements effortlessly
HITRUST certification: At a glance
HITRUST certification entails adhering to the HITRUST CSF requirements which demonstrates your organization's security and privacy posture. The certification process involves a comprehensive self-assessment, which is validated by an external assessor and then reviewed by a QA analyst from HITRUST.
Prerequisites for HITRUST certification
Before pursuing your HITRUST certification, you must define your assessment scope, which depends on the certification or assessment level you want. Currently, you can choose one of the following levels:
- e1: The base-level assessment covers 44 critical controls that every organization should implement to ensure adequate security and privacy. This certification level is best suited for small organizations with simple IT infrastructures.
- i1: A more robust assessment including 180+ controls. The i1 assessment provides greater assurance and is mainly aimed at mid-sized organizations and those that want to use it as an onramp for r2 certification.
- r2: A risk-based assessment with custom controls (out of 2,000+ in total). The r2 certificate is best suited for large organizations with complex risk landscapes and IT infrastructures because it provides the highest level of assurance.
For many organizations, choosing a HITRUST tier depends on their security and compliance landscape, as well as their growth goals, such as accessing new markets or building trust with high-value clients. Your chosen tier will determine the breadth of requirements you need to meet.
Another prerequisite is obtaining access to the HITRUST MyCSF portal before you start the self-assessment. It’s a cloud-based platform that enables all procedural elements of the certification process, such as completing risk analysis and submitting assessments.
Here’s an overview of the key procedural aspects of HITRUST certification:
- Determining assessment scope
- Obtaining access to the MyCSF portal
- Implement HITRUST controls
- Performing a gap assessment and score your control implementation
- Validation of controls by a HITRUST assessor
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
A breakdown of HITRUST certification requirements
We’ll present a general outline of the main HITRUST certification requirements covered across four sections:
- What HITRUST control domains should you cover?
- What are HITRUST scoring thresholds?
- How is HITRUST scoring performed?
- How should you report on implemented controls?
1. What HITRUST security domains should you cover?
One of the reasons why HITRUST certification is beneficial is the breadth of control coverage. The framework prescribes controls across 19 security domains, such as:
- Information Protection Program
- Access Control
- Risk Management
- Transmission Protection
- Incident Management
- Business Continuity & Disaster Recovery
While the required controls are already mapped out for e1 and i1, you must work with your security team to scope controls for r2.
2. What are HITRUST scoring thresholds?
To obtain a certificate, each control domain must reach the prescribed score. The threshold depends on the certification level:
- e1/i1: 83 or higher
- r2: 62 or higher
Under each control domain, you’ll score specific requirement statements, so domain scores are expressed as the average score of all requirement statements under that domain.
You might encounter different scoring scenarios, explained below:
3. How is HITRUST scoring performed?
HITRUST scoring involves the evaluation and scoring of in-scope requirement statements. Once you’ve scored each requirement statement, you add up the scores and divide them by the number of requirements within a domain to get the average domain score, which needs to meet the thresholds discussed above.
To score each requirement statement, you’ll use HITRUST’s Control Maturity Scoring Rubric. It’s a visual tool in the form of a matrix that scores HITRUST requirements according to the PRISMA model. The rubric has five maturity levels:
- Policy
- Procedure
- Implemented
- Measured
- Managed
Note: For e1 and i1 assessments, you only need to evaluate the Implemented level.
4. How should you report on implemented controls?
The framework requires you to report on the controls via MyCSF—HITRUST’s cloud-based SaaS solution to facilitate audits and assessments. The first step is to carry out a self-assessment of your implemented controls and domain scores. Once completed, it’s reviewed by a HITRUST-approved external assessor, who will look for evidence that each requirement statement’s score is valid. Such evidence can be:
- Verbal
- Observed
- Written
- Digital
If your scores are valid, a HITRUST QA analyst will perform a final review to ensure the overall guidelines were met. Once the process is successful, you’ll obtain a certificate corresponding to your selected assessment level.
{{cta_webinar3="/cta-modules"}} | Choosing the right HITRUST certification level and streamlining implementation
3 expert tips for meeting HITRUST certification requirements
A HITRUST assessment can take a considerable amount of time if performed manually or without guidance. Follow these tips to avoid common pitfalls and expedite the process:
- Consider scoping the assessment thoroughly
- Try to perform a readiness assessment beforehand
- Automate the certification process
1. Consider scoping the assessment thoroughly
If you have a maturing security program or are pursuing r2 certification, assessment scoping can be a considerable challenge. You need to outline all the business units, systems, and devices that will be scrutinized under the assessment.
For precise scoping, consider the following factors:
- Needs of your relying parties
- Maturity level of your existing security system
- Expected short-term changes to your IT infrastructure
Another option is to take several approaches to scoping, such as:
- Enterprise-level: All your platforms, networks, and supported infrastructure are considered for the assessment.
- IT service or platform-focused: A select few networks or components of your infrastructure are scoped. You can take this approach if you’re looking to meet specific regulatory or contractual obligations or want to use the assessment as a building block to facilitate organization-wide HITRUST compliance down the line.
- Follow-the-data: The assessment will encompass platforms and infrastructure impacted by the flow of specific data you wish to safeguard. This approach can be used if you handle sensitive data that requires a higher level of protection.
2. Try to perform a readiness assessment beforehand
A readiness assessment is used to identify and bridge any gaps in your in-scope controls. Unlike a validated HITRUST assessment that is mandatory for certification purposes, a readiness assessment is optional and used purely for internal reference.
By performing a readiness assessment, you can simulate the validated assessment process to understand all your HITRUST requirements and scoring workflows. This can bring benefits such as:
- A streamlined and faster certification process
- Increased confidence among stakeholders
- Proactive addressing of gaps in security posture and program maturity
A readiness assessment is also an excellent way to save resources on reassessments and last-minute security reviews down the line, which can be costly and prolong the certification process.
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
3. Automate the certification process
The validation process before certification requires you to present extensive evidence to the external assessor to prove your controls meet HITRUST’s certification requirements. Collecting such evidence can demand considerable time and resources, especially if you have a broad audit scope.
Ideally, you can remove most of the manual work from your security review and evidence collection processes through automation. You can do this in several ways, such as:
- Assessing your CSP’s controls: HITRUST uses the shared responsibility model, so you can inherit the controls established by your cloud service provider (CSP) and improve efficiency.
- Centralizing your security and compliance data: Disparate systems and data sources can slow down evidence collection. Use integrations to keep all relevant data in one accessible hub and provide the necessary proof without painstaking busy work.
- Leveraging an automation solution: HITRUST framework mapped into software helps you meet all the necessary requirements with minimal work. For instance, Vanta is one compliance automation tool that comes with HITRUST-adjusted automation features.
Get HITRUST-certified faster with Vanta
If you want to obtain a HITRUST certificate quickly and seamlessly, Vanta can be the perfect solution. It’s a trust management platform that automates up to 80% of the HITRUST certification requirements.
Vanta is the first and currently the only automaton platform with ready-made e1/i1 and r2 frameworks vetted by HITRUST. With Vanta, you get all the guidance you need to prevent unpleasant surprises during the certification process. You can use the platform to perform a readiness assessment quickly so that all your controls are ready for the validated assessment.
Watch this free webinar to explore Vanta’s HITRUST CSF product and its automation features. Some efficiency-boosting functionalities of the solution include:
- Automated evidence collection powered by 350+ integrations
- Centralized tracking of HITRUST requirements
- Automated gap assessments
- Cross-mapping controls with other supported frameworks (like HIPAA and SOC 2) to avoid duplicative work
- Built-in resources like policy templates and tests
- Integration with HITRUST MyCSF
You can request a demo to get a hands-on overview of these features.
Vanta also offers a vetted service partner network where you can find expert HITRUST assessors to see you through the certification process.
{{cta_simple16="/cta-modules"}} | HITRUST product page
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
| Role: | GRC responsibilities: |
|---|---|
| Board of directors | Central to the overarching GRC strategy, this group sets the direction for the compliance strategy. They determine which standards and regulations are necessary for compliance and align the GRC strategy with business objectives. |
| Chief financial officer | Primary responsibility for the success of the GRC program and for reporting results to the board. |
| Operations managers from relevant departments | This group owns processes. They are responsible for the success and direction of risk management and compliance within their departments. |
| Representatives from relevant departments | These are the activity owners. These team members are responsible for carrying out specific compliance and risk management tasks within their departments and for integrating these tasks into their workflows. |
| Contract managers from relevant department | These team members are responsible for managing interactions with vendors and other third parties in their department to ensure all risk management and compliance measures are being taken. |
| Chief information security officer (CISO) | Defines the organization’s information security policy, designs risk and vulnerability assessments, and develops information security policies. |
| Data protection officer (DPO) or legal counsel | Develops goals for data privacy based on legal regulations and other compliance needs, designs and implements privacy policies and practices, and assesses these practices for effectiveness. |
| GRC lead | Responsible for overseeing the execution of the GRC program in collaboration with the executive team as well as maintaining the organization’s library of security controls. |
| Cybersecurity analyst(s) | Implements and monitors cybersecurity measures that are in line with the GRC program and business objectives. |
| Compliance analyst(s) | Monitors the organization’s compliance with all regulations and standards necessary, identifies any compliance gaps, and works to mitigate them. |
| Risk analyst(s) | Carries out the risk management program for the organization and serves as a resource for risk management across various departments, including identifying, mitigating, and monitoring risks. |
| IT security specialist(s) | Implements security controls within the IT system in coordination with the cybersecurity analyst(s). |
