Which of the following must be confirmed before inheriting requirement scores?

HITRUST allows organizations to inherit scores from third-party providers (such as cloud service providers) when those providers have already completed validated HITRUST assessments. For inheritance to be valid, three conditions must be met:

The Cross Version IDs (CVIDs) must match between the requirement statement in the provider’s assessment and the subscriber’s assessment to ensure alignment across framework versions.

The requirement must be designated as inheritable by HITRUST; not all requirements are eligible for inheritance.

The provider must have published their assessment for inheritance in MyCSF, enabling subscribers to formally link and inherit the validated results.

If any of these are missing, inheritance cannot occur. This ensures transparency, consistency, and proper traceability between assessments.