AI security requirements included

The draft HITRUST CSF requirement statements presented in this section are organized by “topic”. This grouping will not be ported into the HITRUST CSF; instead, the CSF’s existing hierarchy (e.g., categories, domains) will be used. The suggested placement in the existing HITRUST CSF hierarchy for each requirement statement is shown.

The AI security topics used to organize these draft HITRUST CSF requirement statements are as follows:

To understand the mitigations commonly used to help mitigate AI security risks and threats to deployed AI systems, HITRUST analyzed the AI security-specific mitigations discussed in the following authoritative and commercial sources. In the HITRUST lexicon, an “authoritative source” is an externally developed, information-protection-focused framework, standard, guideline, publication, regulation or law. The sources listed below that have been harmonized into the HITRUST CSF as of v11.4.0 are indicated. HITRUST may harmonize more of these sources in future versions of the HITRUST CSF at our discretion and based on your feedback.

Relevant to this analysis: Because these documents were created to satisfy different needs and audiences, they contain recommendations that did not apply to the scope of the HITRUST AI Cybersecurity Certification effort. Namely, we removed from consideration recommendations that:

1. did not relate to AI security for deployed systems,
   
   
2. applied to users of AI systems generally (and not to the deployers of AI systems), as these will be included in version 12 of the HITRUST CSF slated for release in H2 2025, or
   
   
3. did not mitigate security threats specific to or exacerbated by AI but instead mitigated general cybersecurity security threats to traditional IT systems (such as source code leaks via misconfigured repositories), as these are addressed in the underlying HITRUST CSF e1, i1, or r2 assessment that the HITRUST Cybersecurity Certification for Deployed AI Systems is combined with.

The goal of analyzing these sources was not to ensure 100% coverage the AI mitigations discussed. Instead, comparing these sources against one another helped us:

• Understand the AI security control environment, as well as the applicability of various AI security mitigations to different AI deployment scenarios and model types.

• Minimize any subjectivity or personal bias we brought with us into the effort regarding these topics.

• Identify (by omission, consensus, and direct discussion) the AI security mitigations which are generally are and are not employed by organizations who deploy AI systems.

• Identify the mitigations commonly recommended for identified AI security threats.

Other key inputs into our understanding of the AI security threat landscape included:

• Interviews with the authors of several of the documents listed above, as well as other cybersecurity leaders, on season 2 of HITRUST’s “Trust Vs.” podcast. These recordings are available here as well as podcast directories such as Apple Podcasts and YouTube Music.

• Contributions from HITRUST’s AI Assurance Working Group, described in this press release. HITRUST is grateful to the members of this working group:
  • Arun Pamulapti, Databricks
  • David Houlding, Microsoft
  • Ed Schreibman, AWS
  • Emily Soward, AWS
  • Gerry Miller, Cloudticity
  • Gretchen Block, Optum
  • Mitesh Shah, Johnson & Johnson
  • Phillip Draughan, Johnson & Johnson
  • Teresa Godfroy, Sliverthorn