HITRUST in ServiceNow GRC

[kurtiskeling]

Has anyone found a way to import or add HITRUST and associated controls and citations to the ServiceNow GRC environment?   

Thank you.

[Ashik3]

Hi,

If you have citations & controls part of a specific framework, you can import it with UCF integration.

I am not much aware of hittrust 🙂

Thanks,
Ashik

[G Balaji]

HITRUST controls should be available as a download from UCF. 

While I haven't downloaded the citation, I suppose through UCF integration which is a common hub one gets access to all the controls.

[Chris Smith4]

I didn't think HITRUST was available within the UCF?

On the UCF's support page they explain that HITRUST has not authorized UCF to review their controls:

https://support.commoncontrolshub.com/hc/en-us/articles/203196969-Where-is-HITRUST-

Has this changed?

[Jan Spurlin · Accepted solution]

HITRUST is not available from UCF. However, you can leverage some of the transform maps from the UCF integration to import the HITRUST Authority Doc and Citations.  Copy the transform maps and edit them to work with the HITRUST data.  This will give you at least a starting point and see what fields get imported when using UCF.  You probably won't be able to use the last one the Citation to Control - because that is a unique feature offered by UCF.

Note that the one called Default Control Transform imports data into the Policy Statement table.  In UCF what they call "Control" we call "Policy Statement" (aka Control Objective, Control Template, or Requirement - there doesn't seem to be an industry standard on what to call this.)  I also am not familiar with HITRUST to know if they break their citations down into controls or not.