HITRUST CSF v11.8.0: What Changed in May 2026 and What It Means for You

HITRUST updates the CSF regularly, and each version changes what your assessment is measured against. HITRUST CSF v11.8.0, released on 7 May 2026, is a mapping-focused update: it connects the CSF to more outside standards and refreshes some existing mappings. It also matters for timing, because new e1, i1 and rapid assessments must use it.

Here's what changed, what it means for you, and why the AI mappings matter for health AI vendors.

A mapping connects HITRUST requirements to the requirements of another standard. The more mappings the CSF has, the more of your work for one standard can count toward another.

New e1, i1 and rapid assessments must use v11.8.0. If you're starting now, make sure your MyCSF assessment is set up on v11.8.0 and your gap assessment is measured against it. Readiness work done against an older version should be checked against v11.8.0 before you rely on it.

Don't assume. If your assessment was already under way before 7 May 2026, confirm with your assessor which CSF version applies to you and whether anything in your scope needs to change. Ask early, so any change doesn't land in the middle of fieldwork.

The version requirement in v11.8.0 names e1, i1 and rapid assessments. If you're planning an r2, confirm the required CSF version with your assessor when you scope the work.

The refreshed SOC 2 mapping is good news. HITRUST maps to SOC 2, and your existing controls and evidence can be reused, which reduces the work. Read how to use your SOC 2 to get HITRUST faster for a practical path.

The new mapping to the OWASP Top 10 for LLM Applications 2025 is the change most likely to affect health AI companies. Hospitals and payers increasingly want to know how vendors secure AI features, not only how they protect PHI. The OWASP list covers risks such as prompt injection and sensitive data disclosure. With the mapping in the CSF, work you do to test and fix those risks can be tied to your HITRUST controls.

If you provide AI to customers, also look at HITRUST's AI Security Assessment, which can be standalone or paired with your e1, i1 or r2. Our guide to the HITRUST AI Security Assessment explains how it works and how it relates to ISO 42001.

1. Check your assessment type and status. Starting a new e1 or i1? Use v11.8.0. Mid-assessment? Confirm the version with your assessor.
2. Re-check readiness work. If your gap assessment was done against an earlier version, compare it with v11.8.0.
3. Use the new mappings. If you hold SOC 2, PCI DSS or work with NIST or ISO privacy standards, map that work to the CSF so you don't build controls twice.
4. Review AI features. If your product uses LLMs, test it against the OWASP Top 10 for LLM Applications 2025.
5. Pick the right assessment. Not sure whether you need an e1, i1 or r2? Try our HITRUST assessment chooser.

v11.8.0 is one release in the CSF v11 series. The biggest change in v11 was putting all three assessment types on one framework, so you can start small and build up:

• e1: 44 foundational security controls (per CSF v11.9), valid for one year. Built for startups and companies with a limited risk profile.
• i1: 182 control requirements, valid for one year. For organizations with an established program that want to show leading practices.
• r2: the most comprehensive, risk-based assessment, tailored to your organization and valid for two years with an interim assessment.

Because the levels build on each other, work you do for an e1 builds toward an i1 or r2, and i1 work applies to an r2. Our guide to HITRUST e1 vs i1 vs r2 compares them in detail.

The CSF also stays mapped to the standards healthcare organizations already work with, including the HIPAA Security Rule, the NIST Cybersecurity Framework, ISO 27001 and SOC 2. That is why the new and refreshed mappings in v11.8.0 matter: each one lets more of your existing work count.

Mappings are easy to overlook, but they're where much of the practical value of v11.8.0 sits. Each mapping is a bridge between the HITRUST CSF and another standard. When a bridge exists, work you've done for that standard can be traced to HITRUST requirements, and the other way round.

• NIST SP 800-137 is NIST's guidance on continuous monitoring. If your security team already follows it, that monitoring work can now be linked to your HITRUST controls.
• ISO/IEC 29100:2024 is the ISO privacy framework. Companies with privacy programs can connect that work to the CSF.
• PCI DSS v4.0.1 and SOC 2 were already mapped, and v11.8.0 refreshed those mappings so they reflect the current versions.

The point isn't to collect certifications. It's to build each control once and use it everywhere it counts.

If you're working with an assessor, a short conversation now can save rework later:

• Which CSF version will our assessment use?
• Does anything in our scope change because of v11.8.0?
• Can we use the refreshed SOC 2 or PCI DSS mappings to reuse existing evidence?
• If we use AI or LLM features, how will the OWASP Top 10 for LLM Applications 2025 mapping affect our assessment?

Write the answers down and keep them with your project plan.

At CyberWave GRC, we run HITRUST readiness on the current CSF version: scoping, gap assessment, remediation guidance, policies and evidence, MyCSF setup and inheritance mapping. The validated assessment is performed by Huduku AI, an independent HITRUST Authorized External Assessor we work with, and HITRUST performs quality assurance and issues the certification. We never certify our own work.

Our team includes HITRUST CCSFP and CHQP certified practitioners and has worked on 200+ SOC 1 and SOC 2 engagements, so we can put the refreshed SOC 2 mapping to work for you. See our HITRUST consulting page to learn more.