Our description of the CTA approach provided in this appendix is only meant to explain its general principles and potential for practical application. It is not intended to be exhaustive or limited to what has been presented here or as implemented by HITRUST, as many modifications and variations will be apparent to those of ordinary skill in this area of expertise without departing from the scope and spirit of the approach.