Management has asked you to scope out an assessment including your entire network. What are
some examples you may see listed as a primary scoping component?
For an r2 assessment, HITRUST requires a Corrective Action Plan (CAP) when the Control Reference
required for certification scored a 70 or less, and Implementation scores less than 100%.
If an organization's relying party is requesting an Insights Report covering AI risks, which of the
following factors should be added to an assessment?
David, a member of an external assessor organization, helped his client remediate a control gap. As
part of the validation process, David can then review the remediation for appropriateness.