For an r2 assessment, HITRUST requires a Corrective Action Plan (CAP) when the Control Reference
required for certification scored a 70 or less, and Implementation scores less than 100%.
If an organization's relying party is requesting an Insights Report covering AI risks, which of the
following factors should be added to an assessment?
For the External Assessor QA process, the individual who acts as the Quality Assurance Reviewer for
an assessor organization can also be the Engagement Executive.
David, a member of an external assessor organization, helped his client remediate a control gap. As
part of the validation process, David can then review the remediation for appropriateness.