HITRUST AI Security Assessment and Certification Specification

Log AI system inputs and outputs

HITRUST CSF requirement statement [?] (12.09abAISecSystem.6)

The AI system logs all inputs (prompts, queries, inference requests) to and outputs 
(inferences, responses, conclusions) from the AI model, including 
(1) the exact input (e.g., the prompt, the API call), 
(2) the date and time of the input,
(3) the user account making the request, 
(4) where the request originated, 
(5) the exact output provided, and 
(6) the version of the model used. 
AI system logs are 
(7) managed (i.e., retained, protected, and sanitized) in accordance with the organization’s 
policy requirements.

Evaluative elements in this requirement statement [?]
1. The AI system logs the exact input (e.g., the prompt, the API call) to the AI model.
2. The AI system logs the date and time of the input to the AI model.
3. The AI system logs the user account making the request of the AI model.
4. The AI system logs where the request originated.
5. The AI system logs the exact output provided by the AI model.
6. The AI system logs the version of the model providing the output.
7. AI system logs are managed (i.e., retained, protected, and sanitized) in accordance 
with the organization’s policy requirements.


Illustrative procedures for use during assessments [?]

  • Policy: Examine policies related to each evaluative element within the requirement statement. Validate the existence of a written or undocumented policy as defined in the HITRUST scoring rubric.

  • Procedure: Examine evidence that written or undocumented procedures exist as defined in the HITRUST scoring rubric. Determine if the procedures and address the operational aspects of how to perform each evaluative element within the requirement statement.

  • Implemented: Examine evidence that all evaluative elements within the requirement statement have been implemented as defined in the HITRUST scoring rubric, using a sample based test where possible for each evaluative element. Example test(s):
    • For example, review the AI system to ensure the organization logs all inputs (prompts, queries, inference requests) to and outputs (inferences, responses, conclusions) from the AI model, including the exact input, the date and time of the input, the user account making the request, where the request originated, the exact output provided, and the version of the model used. Further, confirm the AI system logs are managed (i.e., retained, protected, and sanitized) in accordance with the organization’s policy requirements.

  • Measured: Examine measurements that formally evaluate and communicate the operation and/or performance of each evaluative element within the requirement statement. Determine the percentage of evaluative elements addressed by the organization’s operational and/or independent measure(s) or metric(s) as defined in the HITRUST scoring rubric. Determine if the measurements include independent and/or operational measure(s) or metric(s) as defined in the HITRUST scoring rubric. Example test(s):
    • For example, measures indicate if the organization logs all inputs (prompts, queries, inference requests) to and outputs (inferences, responses, conclusions) from the AI model, including the exact input, the date and time of the input, the user account making the request, where the request originated, the exact output provided, and the version of the model used. Reviews, tests, or audits are completed by the organization to measure the effectiveness of the implemented controls and to confirm the AI system logs are managed (i.e., retained, protected, and sanitized) in accordance with the organization’s policy requirements.

  • Managed: Examine evidence that a written or undocumented risk treatment process exists, as defined in the HITRUST scoring rubric. Determine the frequency that the risk treatment process was applied to issues identified for each evaluative element within the requirement statement.

Placement of this requirement in the HITRUST CSF [?]

  • Assessment domain: 12 Audit Logging & Monitoring
  • Control category: 09.0 – Communications and Operations Management
  • Control reference: 09.aa Audit Logging

Specific to which parts of the overall AI system? [?]
AI application layer:
  • Application AI safety and security systems
AI platform layer
  • Model safety and security systems


Discussed in which authoritative AI security sources? [?]
  • Generative AI framework for HM Government
    2023, Central Digital and Data Office, UK Government
    • Where:
      • Building generative AI solutions > Building the solution > Data Management > Bullet 3
      • Building generative AI solutions > Building the solution > Testing generative AI solutions > Bullet 3
      • Building generative AI solutions > Building the solution > Data Management > Bullet 4

Discussed in which commercial AI security sources? [?]
  • Snowflake AI Security Framework
    2024, © Snowflake Inc.
    • Where:
      • Model inversion > Mitigations > Bullet 5
      • Attacks on the infrastructure hosting AI services > Mitigations > Continuous monitoring and logging

Control functions against which AI security threats? [?]
Additional information
  • Q: When will this requirement included in an assessment? [?]
    • This requirement will always be added to HITRUST assessments which include the
      Security for AI systems regulatory factor.
    • No other assessment tailoring factors affect this requirement.

  • Q: Will this requirement be externally inheritable? [?] [?]
    • Yes, partially. This may be a responsibility shared between an AI application provider and their AI platform provider (if used), performed independently on separate layers/components of the overall AI system.