Pre-populated default maturity level scores cannot be changed across an assessment object.

In HITRUST assessments, certain maturity level scores may be pre-populated in MyCSF based on scoping factors, inheritance, or framework defaults. However, these default entries are not locked and can be changed by the assessed entity or assessor if evidence supports a different result. For example, if a requirement defaults to “Non-Compliant (0),” but the organization provides documentation showing a control is fully in place, the score may be updated to reflect “Fully Compliant (100).” Similarly, inherited scores from a service provider can be overridden if the organization chooses not to rely on inheritance. HITRUST’s design encourages entities to evaluate each control in their environment rather than accepting defaults blindly. QA will review all adjusted scores against supporting evidence to confirm accuracy.