Now Available! HITRUST AI Certification: A Robust Framework for AI Security Assurance

AI systems, while sharing some infrastructure and operational similarities with traditional IT systems, introduce unique risks requiring specialized cybersecurity measures. Existing IT security models lack the specificity and adaptability needed to protect AI systems from evolving threats, such as attacks targeting AI training data, model manipulation, and supply chain vulnerabilities.

HITRUST's AI Cybersecurity Certification framework effectively fills this gap by offering:

• Transparency and Consistency: A standardized approach for validating and reporting on AI controls across various industries.
• Scalability and Efficiency: Mechanisms to support AI cybersecurity in both small and large organizations, tailored to different AI deployment scenarios.
• Risk-Based Controls: A flexible approach accommodating unique organizational risks without a rigid “one-size-fits-all” approach.

Framework Compatibility: Aligning with ISO/IEC 42001

ISO/IEC 42001:2023, a global standard for AI management, provides a comprehensive but broad framework to guide AI deployment, governance, and operationalization. However, it lacks specific cybersecurity measures essential for AI risk mitigation. HITRUST’s AI Cybersecurity Certification complements ISO/IEC 42001 by mapping HITRUST’s specific AI security controls to the standard’s broader objectives. This allows organizations to achieve both comprehensive management and specific security control, maximizing protection and compliance in AI deployments.

Core Components of the HITRUST AI Certification

The HITRUST AI Certification covers multiple critical components that contribute to a robust security posture for AI systems, spanning from usage guidelines to supply chain security. These include:

1. Assurance Framework

A proven assurance program derived from frameworks like NIST AI RMF, ISO/IEC 42001:2023, and OWASP AI Top 10, validates the implementation, maturity, and effectiveness of AI-specific controls, addressing critical risk areas such as model training data integrity, AI model resilience, and supply chain security. This framework adapts dynamically to new threats, reflecting HITRUST’s established threat-adaptive model.

2. Continuous Improvement and Measurable Outcomes

With AI risks evolving rapidly, HITRUST’s adaptive approach and measurable standards allow for consistent benchmarking, providing organizations with critical metrics to optimize AI security. These new AI controls can be added to an e1, i1, and r2 HITRUST certification. 

3. Diversity and Shared Responsibility

The certification supports diverse organizational needs, allowing smaller entities to inherit most HITRUST-certified cloud security controls. For large organizations, it facilitates a layered approach, ensuring AI security without extensive resource investments.

4. Comprehensive Coverage Across AI Layers

The HITRUST AI Certification assesses controls across three key layers:

• AI Usage Layer: Ensures proper governance for end-users and workforce training (to be incorporated in HITRUST CSF v12).
• AI Application Layer: Addresses security for the interface used by end-users, capturing controls for input sanitization and model safety systems.
• AI Platform Layer: Assesses the infrastructure and tools for AI model development and deployment, including model safety, dataset sanitization, and output filtering.

Types of AI and Applicable Security Controls

The HITRUST AI Certification applies to a wide range of AI models:

• Rule-Based AI (e.g., expert systems): Includes AI relying on deterministic rules.
• Predictive AI: Covers machine learning models trained on structured data.
• Generative AI: Addresses AI models producing novel outputs, such as large language models (LLMs) and retrieval augmented generation (RAG).

AI has specific security controls to mitigate risks like data leakage, inaccurate output, and compliance breaches. Generative AI models, for instance, require robust filters and controls to prevent unintended disclosures of sensitive information.

HITRUST’s Response to the Evolving AI Threat Landscape

In alignment with security recommendations from ENISA, NIST, and OWASP, HITRUST has established a framework that adapts to the changing threat landscape, actively collaborating with AI and cloud service providers to address novel AI security challenges. Additionally, HITRUST is a risk management framework that is designed to be threat-adaptive utilizing and cross-referencing industry leading analysis, indicators, services, and tactics with the HITRUST CSF. HITRUST's proactive and layered model incorporates security considerations for AI systems while facilitating control inheritance and regulatory alignment, supporting risk management through:

• Continuous Threat Monitoring: Ensures emerging threats are mitigated.
• Proven Maturity Models: Aligns organizational security posture with established frameworks and provides a mechanism for continuous improvement.
• Regulatory Consistency: Provides a flexible model adaptable to different regulatory requirements, improving compliance without compromising operational agility.

Client Offer: Special Report Credit Pricing for Early Adopters

Clients who engage with HITRUST or Coalfire before the close of 2024 can benefit from special report credit pricing on their HITRUST AI certification assessments. This offer allows early adopters to achieve best-in-class AI security at reduced costs, providing proactive protection aligned with both organizational needs and regulatory standards.

Conclusion

The HITRUST AI Cybersecurity Certification empowers organizations to build, deploy, and manage AI technologies with confidence, grounded in a model that has a proven track record for cybersecurity. In partnership with global leaders in AI and cloud services, HITRUST and Coalfire are committed to setting the standard for comprehensive AI risk management, offering organizations the tools to secure AI systems effectively and efficiently. 

For More Information

Clients interested in securing their AI systems with the HITRUST AI Certification are encouraged to reach out to their HITRUST account representative or Coalfire before the end of 2024 to access the special report credit pricing and protect their systems from emerging AI threats.