When creating a new r2 assessment you are required to use the latest version of...

HITRUST requires that all new r2 assessments use the latest available version of the CSF framework. This ensures that assessments reflect the most current regulatory mappings, authoritative source updates, and industry security practices. For example, if HITRUST releases CSF version 11.x, new assessments initiated after its release must adopt that version. Organizations with ongoing assessments may complete them on the prior version but must transition to the latest version for new engagements. This policy ensures consistency and prevents outdated control sets from being used in certification, which could weaken reliance by stakeholders. Keeping assessments aligned with the current version also reflects HITRUST’s commitment to maintaining the CSF as a “living framework.”