1. CSF Roadmap 2015 and Beyond Presented By Bryan S. Cline, Ph.D.
Presented For
HITRUST

2. Introduction Information Security Implementation Manual
Compliance Reporting System
U.S. Healthcare Industry Implementation Standards
Control Objectives
Primary Ref: ISO/IEC 27002:2005
& ISO/IEC 27001:2005
Self Assessment Process
Certification Process
Standards and Regulations Cross Reference Matrix
Standards and Materials Leveraged
HIPAA/HITECH
HITRUST member experience
NIST 800 Series
CMS
The Joint Commission
Others
FTC Red Flags
Mass. 201 CMR 17.00

3. Outline

4. NIST-CMS Harmonization (Publication Updates)
2014 CSF v6
NIST SP r4 (Apr 2013 FPD)
CMS IS ARS v1.5 (2012)
NIST-CMS Harmonization (Publication Updates)
Title 1 TX Admin. Code (TX Standards),
Privacy requirements to support TX certification of the HIPAA Privacy Rule
Dozens of other federal and state legislation and regulations related to the protection of health information

5. NIST Cybersecurity Framework v1 (2014)
Something new – 2014 CSF v6.1
PCI-DSS v3.0 (2013)
HIPAA Omnibus Rule (2013)
ISO/IEC 27001:2013 (2013)
ISO/IEC 27002:2013 (2013)
NIST Cybersecurity Framework v1 (2014)

6. Minimum Acceptable Risk Safeguards–Exchanges (MARS-E) (2012)
Something new – 2014 CSF v6.2
Minimum Acceptable Risk Safeguards–Exchanges (MARS-E) (2012)
Catalog of Minimum Acceptable Risk Controls for Exchanges v1 (2012)
Includes references to IRS Pub 1075 requirements for FTI, which also supports TX Covered Entity Privacy & Security Certification requirements
NIST HSR Toolkit v1 (2011)
Unknown if NIST plans to update the tool
OCR Audit Protocol v2 (2014)
When released
May also impact CSF Assurance Program

7. Considering COBIT 5, but …
2015 CSF v7 and beyond …
Considering COBIT 5, but …

8. See you in 2015!

9. Dr. Bryan S. Cline, CISSP-ISSEP, CISM, CISA, CCSFP, HCISPP
HITRUST Advisor