Organizations in highly regulated industries like healthcare are often overwhelmed by the breadth of federal, state, and local regulations they need to keep up with, such as HIPAA and HITECH. There is a degree of complexity and ambiguity in many of these regulations, and complying with each demands considerable resources and efforts from your team.
To make compliance easier for organizations with diverse regulatory needs, HITRUST created an elaborate solution in the form of a Common Security Framework (CSF). The CSF also offers the necessary guidance and assurance to help teams demonstrate trust and credibility with stakeholders.
In this guide, we’ll cover the key aspects of HITRUST compliance, including:
- What HITRUST compliance is
- Who needs HITRUST compliance
- Which assessment levels to target
- How the certification logistics work
What is HITRUST compliance?
HITRUST compliance is the process of obtaining a HITRUST certificate for your organization by implementing the HITRUST CSF. It requires you to strengthen and demonstrate a solid security posture and ensure your controls meet HITRUST’s standards.
The HITRUST CSF was launched in 2007 and has evolved significantly since then. As of October 2024, the latest version is v11.3.0, which primarily focuses on compliance efficiency and optimal resource use.
By adopting HITRUST's risk-based framework, you can implement industry-standard security controls that overlap with numerous regulations and standards, such as:
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
Who needs HITRUST certification?
HITRUST CSF is not mandated by the federal government but is a highly recommended certification in the security and compliance space. It was initially designed for healthcare organizations but has now evolved to be industry-agnostic.
The framework is particularly important for organizations that process or store protected health information (PHI) because several HITRUST controls are mapped to HIPAA. A common issue with HIPAA is the regulation’s interpretative nature, which makes compliance challenging at times. With the HITRUST CSF, you get clear recommendations about the requirements and controls that simplify HIPAA compliance.
Today, the HITRUST CSF mappings extend far beyond HIPAA, which makes its certification valuable to many organizations, such as:
- Businesses in healthcare technology
- Insurance companies
- Startups looking for bigger clients
Benefits of HITRUST certification
Here are some of the major benefits of obtaining a HITRUST certificate:
- Simplified regulatory compliance: Since HITRUST incorporates and harmonizes 50+ authoritative regulations and standards, pursuing its certification makes your overall compliance workflow efficient.
- Enhanced cybersecurity: By adopting the HITRUST CSF, you implement industry-accepted policies, practices, and controls that fortify your cybersecurity across domains like:
- Network security
- Incident response system
- Access controls
- Effective third-party risk management: Each third party you work with expands your potential attack surface, complicating your risk landscape. The HITRUST CSF provides standard measures to assess your third-party security and gain the necessary assurances.
- Stakeholder trust and transparency: A HITRUST certificate serves as proof of a strong security posture across industries. This makes it easier to build trust with customers, prospects, and other stakeholders.
- Security program scaling: If you’re looking to mature your security program, the wide scope of the HITRUST CSF will steer you toward comprehensive controls and effective best practices.
Bonus: Read this guide for a more extensive coverage of HITRUST’s growth-boosting benefits.
Basic compliance structure of HITRUST CSF
To obtain a HITRUST certification, you will need to reach the defined score threshold across 19 control domains:
- Information Security Management Program
- Access Control
- Risk Management
- Security Incident Management
- Configuration Management
- Cryptographic Controls
- Security Policy
- Personnel Security
- Physical and Environmental Protection
- Security Awareness and Training
- Incident Response
- Business Continuity and Disaster Recovery Planning
- Third-Party Assurance
- Audit and Accountability
- Network Protection
- Data Protection and Privacy
- Systems and Communications Protection
- Incident Response and Management
- Configuration Management and Vulnerability Management
The number of controls you need to map depends on which HITRUST assessment level you’re aiming for. The HITRUST CSF v11.3.0 offers 14 control categories for you to choose from, which are further divided into 49 objectives and 156 control references. You can use these objectives and references to guide your choice of controls.
3 HITRUST assessment levels you can choose from
If you’re looking to obtain a HITRUST certificate, you can target three assessment levels:
- e1 (Essential)
- i1 (Intermediate)
- r2 (Risk-based)
{{cta_webinar3="/cta-modules"}} | Choosing the right HITRUST certification level and streamlining implementation
1. HITRUST e1
HITRUST e1 is a base-level assessment best suited for small organizations or those with a simpler risk profile and IT infrastructure. It encompasses 44 critical controls that ensure the foundational security standards for every organization.
If you have an established security program, chances are you already have many of the e1 controls in place, so getting certified shouldn’t involve considerable upgrades to your security posture. The certificate is valid for one year, after which it must be renewed.
Some use cases of the e1 certification include:
- Obtaining assurances
- Evaluating third parties
- Building trust in your industry
2. HITRUST i1
HITRUST i1 is a more elaborate assessment offering greater assurances, and it’s mostly aimed at mid-sized organizations or those with more comprehensive security needs. It covers 187 controls, including the 44 included in the e1. The i1 certificate is also valid for a year.
The i1 assessment is a moderate-level security certification for organizations in any industry. It may require additional effort in terms of updating technology systems and processes, creating robust policy documentation, etc.
It’s worth pursuing the certificate if you want to:
- Demonstrate comprehensive protection to stakeholders
- Expand to newer regulatory markets
- Want to prepare for an r2 assessment
3. HITRUST r2
As the highest HITRUST certification level, the r2 is intended for organizations with a diverse risk landscape and comprehensive security infrastructure. You should pursue it if you want the most advanced security controls and build strong industry credibility.
Unlike e1 and i1, an r2 certificate is valid for two years, though you need to perform an interim assessment to stay certified.
Another notable difference is in the nature and number of controls. The r2 assessment is risk-based, so it doesn’t come with a predefined set of controls. Instead, you tailor it to your risk profile—you’ll have to follow select options from over 2,000 controls based on your responses in the risk-based scoping questionnaire.
The average size of the r2 assessment is 385 controls, which calls for extensive audits and security reviews. The effort can certainly pay off, especially if your organization:
- Seeks high-coverage security and risk management practices
- Handles numerous international security and privacy regulations
- Works with clients that expect high-security environments
An overview of the HITRUST certification process
Regardless of your chosen certification level, the HITRUST certification process consists of five basic steps:
- Pre-assessment
- Readiness assessment
- Validated assessment
- Quality assurance
- Deliverable preparation and reviews
The following sections provide a high-level procedural overview of the process—you can find a more granular coverage here.
Step 1: Pre-assessment
During the pre-assessment stage, you need to complete up to six web forms:
- Name and security
- Assessment options
- Organization information
- Scope of the assessment
- Default scoring profile
- Factors
The Factors form above is only applicable to r2 assessments. Additionally, an external assessor must review and approve the forms—they can also fill out the forms on your behalf for e1 and i1 levels.
You’ll need to make two important decisions at this stage:
- Which assessment level you want
- How much of your IT infrastructure will be covered by the assessment
The second decision can be challenging, especially if you have a diverse IT infrastructure. Your goal is to outline the platforms and systems, facilities, and outsourced services that fall within HITRUST’s scope and work toward achieving the corresponding controls.
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
Step 2: Readiness assessment
A readiness assessment lets you perform a gap analysis and test your controls against the applicable HITRUST requirements. It’s not mandatory or reviewed by HITRUST, but it’s highly beneficial because it streamlines the validated assessment workflow in the next step.
For this step, you’ll perform comprehensive security reviews to get your controls ready for HITRUST certification. The preferred way you’ll do this depends on the certification level, as explained in the following table:
Step 3: Validated assessment
A HITRUST validated assessment revolves around a self-assessment completed by your organization and validated by an external assessor. The self-assessment is done using HITRUST’s Control Maturity Scoring Rubric, which lets you score controls according to their strength and coverage.
After scoring is completed, an external assessor will verify the scores’ validity through various activities, such as:
- Personnel interviews
- Walkthroughs
- Policy inspections
You’ll need to back up your scores with sufficient proof to demonstrate their strength and coverage, which typically involves extensive evidence collection.
Step 4: Quality assurance
After the external assessor validates your self-assessment and addresses any issues, a HITRUST QA analyst will perform the final verification of your controls’ alignment with the CSF’s requirements.
The QA analyst will review the key documentation you submit and your self-assessment, after which they might assign two types of tasks to your organization or the external assessor:
- General tasks: Requests or instructions to address an issue discovered during the QA process
- Proposed tasks: Suggested amendments that the external assessor or your organization should implement
If there are no issues (or you’ve successfully resolved the discovered ones), the QA process will conclude, and you can be issued the chosen HITRUST certification level.
Step 5: Deliverable preparation and reviews
Upon the successful completion of the HITRUST audit, you will receive the target QA report:
- HITRUST Essentials 1-year (e1) Certification Report
- HITRUST Implemented 1-year (i1) Certification Report
- HITRUST Risk-based, 2-year (r2) Certification Report
If you opt for the r2 certificate, you’ll also obtain a NIST Cybersecurity Framework Report as long as you cross the scoring threshold.
You have 30 days to review the report, during which you can request amendments. After any discovered issues are resolved, you’ll get the final report.
{{cta_testimonial14="/cta-modules"}}
Obtain a HITRUST certificate effortlessly with Vanta
HITRUST is a valuable certification for organizations in healthcare, finance, or technology, but the certification process can be lengthy if you do it manually and without proper guidance. If you want more streamlined HITRUST compliance, leverage Vanta—a trust management platform that automates up to 80% of the certification requirements.
Vanta is the first pre-built, custom solution for HITRUST. It includes the controls, documents, and policies necessary to demonstrate your commitment to safeguarding sensitive data, including protected health information (PHI)—all in a way that can be validated by HITRUST.
The platform’s dedicated HITRUST CSF product is equipped with plenty of useful features, most notably:
- Automated gap assessment for streamlined readiness assessments
- Centralized documentation and tracking of the HITRUST CSF requirements
- Automated evidence collection
- Real-time continuous monitoring
- Over 350 integrations, including integration with MyCSF
Watch this webinar or request a demo to learn more about Vanta’s HITRUST CSF solution.
{{cta_simple16="/cta-modules"}} | HITRUST product page
Introduction to HITRUST
What is HITRUST compliance? Your complete guide
Introduction to HITRUST
Organizations in highly regulated industries like healthcare are often overwhelmed by the breadth of federal, state, and local regulations they need to keep up with, such as HIPAA and HITECH. There is a degree of complexity and ambiguity in many of these regulations, and complying with each demands considerable resources and efforts from your team.
To make compliance easier for organizations with diverse regulatory needs, HITRUST created an elaborate solution in the form of a Common Security Framework (CSF). The CSF also offers the necessary guidance and assurance to help teams demonstrate trust and credibility with stakeholders.
In this guide, we’ll cover the key aspects of HITRUST compliance, including:
- What HITRUST compliance is
- Who needs HITRUST compliance
- Which assessment levels to target
- How the certification logistics work
What is HITRUST compliance?
HITRUST compliance is the process of obtaining a HITRUST certificate for your organization by implementing the HITRUST CSF. It requires you to strengthen and demonstrate a solid security posture and ensure your controls meet HITRUST’s standards.
The HITRUST CSF was launched in 2007 and has evolved significantly since then. As of October 2024, the latest version is v11.3.0, which primarily focuses on compliance efficiency and optimal resource use.
By adopting HITRUST's risk-based framework, you can implement industry-standard security controls that overlap with numerous regulations and standards, such as:
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
Who needs HITRUST certification?
HITRUST CSF is not mandated by the federal government but is a highly recommended certification in the security and compliance space. It was initially designed for healthcare organizations but has now evolved to be industry-agnostic.
The framework is particularly important for organizations that process or store protected health information (PHI) because several HITRUST controls are mapped to HIPAA. A common issue with HIPAA is the regulation’s interpretative nature, which makes compliance challenging at times. With the HITRUST CSF, you get clear recommendations about the requirements and controls that simplify HIPAA compliance.
Today, the HITRUST CSF mappings extend far beyond HIPAA, which makes its certification valuable to many organizations, such as:
- Businesses in healthcare technology
- Insurance companies
- Startups looking for bigger clients
Benefits of HITRUST certification
Here are some of the major benefits of obtaining a HITRUST certificate:
- Simplified regulatory compliance: Since HITRUST incorporates and harmonizes 50+ authoritative regulations and standards, pursuing its certification makes your overall compliance workflow efficient.
- Enhanced cybersecurity: By adopting the HITRUST CSF, you implement industry-accepted policies, practices, and controls that fortify your cybersecurity across domains like:
- Network security
- Incident response system
- Access controls
- Effective third-party risk management: Each third party you work with expands your potential attack surface, complicating your risk landscape. The HITRUST CSF provides standard measures to assess your third-party security and gain the necessary assurances.
- Stakeholder trust and transparency: A HITRUST certificate serves as proof of a strong security posture across industries. This makes it easier to build trust with customers, prospects, and other stakeholders.
- Security program scaling: If you’re looking to mature your security program, the wide scope of the HITRUST CSF will steer you toward comprehensive controls and effective best practices.
Bonus: Read this guide for a more extensive coverage of HITRUST’s growth-boosting benefits.
Basic compliance structure of HITRUST CSF
To obtain a HITRUST certification, you will need to reach the defined score threshold across 19 control domains:
- Information Security Management Program
- Access Control
- Risk Management
- Security Incident Management
- Configuration Management
- Cryptographic Controls
- Security Policy
- Personnel Security
- Physical and Environmental Protection
- Security Awareness and Training
- Incident Response
- Business Continuity and Disaster Recovery Planning
- Third-Party Assurance
- Audit and Accountability
- Network Protection
- Data Protection and Privacy
- Systems and Communications Protection
- Incident Response and Management
- Configuration Management and Vulnerability Management
The number of controls you need to map depends on which HITRUST assessment level you’re aiming for. The HITRUST CSF v11.3.0 offers 14 control categories for you to choose from, which are further divided into 49 objectives and 156 control references. You can use these objectives and references to guide your choice of controls.
3 HITRUST assessment levels you can choose from
If you’re looking to obtain a HITRUST certificate, you can target three assessment levels:
- e1 (Essential)
- i1 (Intermediate)
- r2 (Risk-based)
{{cta_webinar3="/cta-modules"}} | Choosing the right HITRUST certification level and streamlining implementation
1. HITRUST e1
HITRUST e1 is a base-level assessment best suited for small organizations or those with a simpler risk profile and IT infrastructure. It encompasses 44 critical controls that ensure the foundational security standards for every organization.
If you have an established security program, chances are you already have many of the e1 controls in place, so getting certified shouldn’t involve considerable upgrades to your security posture. The certificate is valid for one year, after which it must be renewed.
Some use cases of the e1 certification include:
- Obtaining assurances
- Evaluating third parties
- Building trust in your industry
2. HITRUST i1
HITRUST i1 is a more elaborate assessment offering greater assurances, and it’s mostly aimed at mid-sized organizations or those with more comprehensive security needs. It covers 187 controls, including the 44 included in the e1. The i1 certificate is also valid for a year.
The i1 assessment is a moderate-level security certification for organizations in any industry. It may require additional effort in terms of updating technology systems and processes, creating robust policy documentation, etc.
It’s worth pursuing the certificate if you want to:
- Demonstrate comprehensive protection to stakeholders
- Expand to newer regulatory markets
- Want to prepare for an r2 assessment
3. HITRUST r2
As the highest HITRUST certification level, the r2 is intended for organizations with a diverse risk landscape and comprehensive security infrastructure. You should pursue it if you want the most advanced security controls and build strong industry credibility.
Unlike e1 and i1, an r2 certificate is valid for two years, though you need to perform an interim assessment to stay certified.
Another notable difference is in the nature and number of controls. The r2 assessment is risk-based, so it doesn’t come with a predefined set of controls. Instead, you tailor it to your risk profile—you’ll have to follow select options from over 2,000 controls based on your responses in the risk-based scoping questionnaire.
The average size of the r2 assessment is 385 controls, which calls for extensive audits and security reviews. The effort can certainly pay off, especially if your organization:
- Seeks high-coverage security and risk management practices
- Handles numerous international security and privacy regulations
- Works with clients that expect high-security environments
An overview of the HITRUST certification process
Regardless of your chosen certification level, the HITRUST certification process consists of five basic steps:
- Pre-assessment
- Readiness assessment
- Validated assessment
- Quality assurance
- Deliverable preparation and reviews
The following sections provide a high-level procedural overview of the process—you can find a more granular coverage here.
Step 1: Pre-assessment
During the pre-assessment stage, you need to complete up to six web forms:
- Name and security
- Assessment options
- Organization information
- Scope of the assessment
- Default scoring profile
- Factors
The Factors form above is only applicable to r2 assessments. Additionally, an external assessor must review and approve the forms—they can also fill out the forms on your behalf for e1 and i1 levels.
You’ll need to make two important decisions at this stage:
- Which assessment level you want
- How much of your IT infrastructure will be covered by the assessment
The second decision can be challenging, especially if you have a diverse IT infrastructure. Your goal is to outline the platforms and systems, facilities, and outsourced services that fall within HITRUST’s scope and work toward achieving the corresponding controls.
{{cta_withimage19="/cta-modules"}} | HITRUST Compliance Checklist
Step 2: Readiness assessment
A readiness assessment lets you perform a gap analysis and test your controls against the applicable HITRUST requirements. It’s not mandatory or reviewed by HITRUST, but it’s highly beneficial because it streamlines the validated assessment workflow in the next step.
For this step, you’ll perform comprehensive security reviews to get your controls ready for HITRUST certification. The preferred way you’ll do this depends on the certification level, as explained in the following table:
Step 3: Validated assessment
A HITRUST validated assessment revolves around a self-assessment completed by your organization and validated by an external assessor. The self-assessment is done using HITRUST’s Control Maturity Scoring Rubric, which lets you score controls according to their strength and coverage.
After scoring is completed, an external assessor will verify the scores’ validity through various activities, such as:
- Personnel interviews
- Walkthroughs
- Policy inspections
You’ll need to back up your scores with sufficient proof to demonstrate their strength and coverage, which typically involves extensive evidence collection.
Step 4: Quality assurance
After the external assessor validates your self-assessment and addresses any issues, a HITRUST QA analyst will perform the final verification of your controls’ alignment with the CSF’s requirements.
The QA analyst will review the key documentation you submit and your self-assessment, after which they might assign two types of tasks to your organization or the external assessor:
- General tasks: Requests or instructions to address an issue discovered during the QA process
- Proposed tasks: Suggested amendments that the external assessor or your organization should implement
If there are no issues (or you’ve successfully resolved the discovered ones), the QA process will conclude, and you can be issued the chosen HITRUST certification level.
Step 5: Deliverable preparation and reviews
Upon the successful completion of the HITRUST audit, you will receive the target QA report:
- HITRUST Essentials 1-year (e1) Certification Report
- HITRUST Implemented 1-year (i1) Certification Report
- HITRUST Risk-based, 2-year (r2) Certification Report
If you opt for the r2 certificate, you’ll also obtain a NIST Cybersecurity Framework Report as long as you cross the scoring threshold.
You have 30 days to review the report, during which you can request amendments. After any discovered issues are resolved, you’ll get the final report.
{{cta_testimonial14="/cta-modules"}}
Obtain a HITRUST certificate effortlessly with Vanta
HITRUST is a valuable certification for organizations in healthcare, finance, or technology, but the certification process can be lengthy if you do it manually and without proper guidance. If you want more streamlined HITRUST compliance, leverage Vanta—a trust management platform that automates up to 80% of the certification requirements.
Vanta is the first pre-built, custom solution for HITRUST. It includes the controls, documents, and policies necessary to demonstrate your commitment to safeguarding sensitive data, including protected health information (PHI)—all in a way that can be validated by HITRUST.
The platform’s dedicated HITRUST CSF product is equipped with plenty of useful features, most notably:
- Automated gap assessment for streamlined readiness assessments
- Centralized documentation and tracking of the HITRUST CSF requirements
- Automated evidence collection
- Real-time continuous monitoring
- Over 350 integrations, including integration with MyCSF
Watch this webinar or request a demo to learn more about Vanta’s HITRUST CSF solution.
{{cta_simple16="/cta-modules"}} | HITRUST product page
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
What’s a Rich Text element?
What’s a Rich Text element?The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.
The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.Static and dynamic content editing
Static and dynamic content editingA rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!
A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!How to customize formatting for each rich text
How to customize formatting for each rich textHeadings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.
Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
| Role: | GRC responsibilities: |
|---|---|
| Board of directors | Central to the overarching GRC strategy, this group sets the direction for the compliance strategy. They determine which standards and regulations are necessary for compliance and align the GRC strategy with business objectives. |
| Chief financial officer | Primary responsibility for the success of the GRC program and for reporting results to the board. |
| Operations managers from relevant departments | This group owns processes. They are responsible for the success and direction of risk management and compliance within their departments. |
| Representatives from relevant departments | These are the activity owners. These team members are responsible for carrying out specific compliance and risk management tasks within their departments and for integrating these tasks into their workflows. |
| Contract managers from relevant department | These team members are responsible for managing interactions with vendors and other third parties in their department to ensure all risk management and compliance measures are being taken. |
| Chief information security officer (CISO) | Defines the organization’s information security policy, designs risk and vulnerability assessments, and develops information security policies. |
| Data protection officer (DPO) or legal counsel | Develops goals for data privacy based on legal regulations and other compliance needs, designs and implements privacy policies and practices, and assesses these practices for effectiveness. |
| GRC lead | Responsible for overseeing the execution of the GRC program in collaboration with the executive team as well as maintaining the organization’s library of security controls. |
| Cybersecurity analyst(s) | Implements and monitors cybersecurity measures that are in line with the GRC program and business objectives. |
| Compliance analyst(s) | Monitors the organization’s compliance with all regulations and standards necessary, identifies any compliance gaps, and works to mitigate them. |
| Risk analyst(s) | Carries out the risk management program for the organization and serves as a resource for risk management across various departments, including identifying, mitigating, and monitoring risks. |
| IT security specialist(s) | Implements security controls within the IT system in coordination with the cybersecurity analyst(s). |
