HITRUST AI Security Assessment and Certification Specification

Inspection of AI software assets

HITRUST CSF requirement statement [?] (07.10mAISecOrganizational.6)

To find potentially exploitable vulnerabilities, the organization inspects downloaded AI software assets 
before use—including 
(1) models (e.g., such as those sourced from online model zoos); 
(2) software packages used to create, train, and/or deploy models (e.g., python packages); and
(3) language model tools such as agents and plugins (if used). 
The organization 
(4) acts upon the results, as necessary.

Evaluative elements in this requirement statement [?]
1. To find potentially exploitable vulnerabilities, the organization inspects downloaded AI models 
before use (e.g., such as those sourced from online model zoos).
2. To find potentially exploitable vulnerabilities, the organization inspects downloaded software 
packages (e.g., python packages) used to create, train, and/or deploy models before use.
3. To find potentially exploitable vulnerabilities, the organization inspects downloaded 
language model tools such as agents and plugins before use (if used).
4. The organization acts upon the results, as necessary.


Illustrative procedures for use during assessments [?]

  • Policy: Examine policies related to each evaluative element within the requirement statement. Validate the existence of a written or undocumented policy as defined in the HITRUST scoring rubric.

  • Procedure: Examine evidence that written or undocumented procedures exist as defined in the HITRUST scoring rubric. Determine if the procedures and address the operational aspects of how to perform each evaluative element within the requirement statement.

  • Implemented: Examine evidence that all evaluative elements within the requirement statement have been implemented as defined in the HITRUST scoring rubric, using a sample based test where possible for each evaluative element. Example test(s):
    • For example, select a sample of downloaded AI software assets and confirm they were inspected before use. Further, confirm that the organization acts upon the inspection results, as necessary.

  • Measured: Examine measurements that formally evaluate and communicate the operation and/or performance of each evaluative element within the requirement statement. Determine the percentage of evaluative elements addressed by the organization’s operational and/or independent measure(s) or metric(s) as defined in the HITRUST scoring rubric. Determine if the measurements include independent and/or operational measure(s) or metric(s) as defined in the HITRUST scoring rubric. Example test(s):
    • For example, measures indicate percentage of the organization’s downloaded AI software assets that were not inspected before use. Reviews, tests, or audits are completed by the organization to measure the effectiveness of the implemented controls and to confirm that all AI software assets are inspected before use.

  • Managed: Examine evidence that a written or undocumented risk treatment process exists, as defined in the HITRUST scoring rubric. Determine the frequency that the risk treatment process was applied to issues identified for each evaluative element within the requirement statement.

Placement of this requirement in the HITRUST CSF [?]

  • Assessment domain: 07 Vulnerability Management
  • Control category: 10.0 – Information Systems Acquisition, Development, and Maintenance
  • Control reference: 10.m – Control of Technical Vulnerabilities

Specific to which parts of the overall AI system? [?]
AI application layer:
  • The deployed AI application (Considered in the associated HITRUST e1, i1, or r2 assessment)
AI platform layer:
  • The deployed AI model
  • Model engineering environment and model pipeline

Discussed in which authoritative AI security sources? [?]
  • OWASP 2023 Top 10 for LLM Applications
    Oct. 2023, © The OWASP Foundation
    • Where:
      • LLM05: Supply chain vulnerabilities > Prevention and mitigation strategies > Bullet #8
      • LLM07: Insecure plugin design > Prevention and mitigation strategies > Bullet #3

Discussed in which commercial AI security sources? [?]
  • Databricks AI Security Framework
    Sept. 2024, © Databricks
    • Where:
      • Control DASF 41: Platform security – Secure SDLC
      • Control DASF 53: Third-party library control

Control functions against which AI security threats? [?]
Additional information
  • Q: When will this requirement included in an assessment? [?]
    • This requirement will always be added to HITRUST assessments which include the
      Security for AI systems regulatory factor.
    • No other assessment tailoring factors affect this requirement.

  • Q: When is this requirement applicable, and when could it be inapplicable?
    • This requirement applies regardless of the model’s provenance and regardless of the AI system architecture.
    • Element #1 is only applicable when the AI system uses an AI model sourced from an online model zoo / model hub.
    • Element #2 is only applicable when the organization uses software packages downloaded from online package repositories.
    • Element #3 is only applicable when language model tools such as agents or plugins are used.

  • Q: Will this requirement be externally inheritable? [?] [?]
    • Yes, fully. This requirement may be the sole responsibility of the AI platform provider and/or model creator. Or, depending on the AI system’s architecture, only evaluative elements that are the sole responsibility of the AI platform provider and/or model creator provider apply.