A Copy-Ready HITRUST CSF 11.9.0 Transition Decision Memo

Purpose of This Template

HITRUST has released CSF version 11.9.0, announcing that versions 11.0 through 11.3.2 will no longer be available for new creations in MyCSF after December 31, 2026. Existing objects can still be submitted for certification if done by March 31, 2027. For e1 and i1 assessments, the same timeline applies to version 11.8.

This situation presents a decision point. You don't have to switch to 11.9.0 immediately, but you must document your decision to stay or move. This memo template provides a defensible record of your decision, covering version choice, AI and post-quantum cryptography impacts, and scoping changes for your next assessment. Use it to inform your CISO, your assessor, and your future self.

Prerequisites

Before completing the template, gather:

• The version of your last HITRUST assessment and current certification expiry
• Current MyCSF object status (created, in progress, or not yet created)
• System inventory, including AI features or agent-based components
• Cryptographic inventory (algorithms, key lengths, TLS versions, PKI dependencies)
• Current risk register and risk assessment methodology
• Access to HITRUST's release documentation for 11.9.0 and related HAA notices

The Template

Copy everything below into your document system and replace the bracketed fields.

HITRUST CSF VERSION TRANSITION DECISION MEMO

Document owner: [Name, role]
Date: [Date]
Approver: [CISO or equivalent]
Review date: [Date]

1. Current State

• Assessment type: [e1 / i1 / r2]
• Current CSF version: [e.g., 11.3.2]
• Certification expiry: [Date]
• MyCSF object created on or before 12/31/2026? [Yes / No]
• Planned submission date: [Date]

2. Version Decision

• Decision: [Stay on current version / Move to 11.9.0]
• Rationale: [2-3 sentences]
• If staying: confirm submission is on or before March 31, 2027. Submission owner: [Name]
• If moving: target object creation date: [Date]. Assessor notified: [Yes / No]

3. AI Scope Assessment

• Do we operate AI-enabled systems in scope? [Yes / No]
• Do any use agentic components (systems that take autonomous actions)? [Yes / No]
• Is the "Agentic AI" selectable factor in the AI Security assessment relevant? [Yes / No / To be determined]
• Applications tested against OWASP Top 10 for Agentic Applications: [List or "None yet"]
• AI-related control owners: [Names]

4. Cryptography and Post-Quantum Review

• Cryptographic inventory complete? [Yes / No / Date due]
• Encryption controls reviewed for post-quantum considerations? [Yes / No]
• TLS, PKI, and passkey requirements reviewed against updated control language? [Yes / No]
• Post-quantum risk recorded in risk register? [Yes / No. Risk ID: ___]
• Immediate implementation required? [Yes / No. Justification: ___]

5. Authoritative Source Impact

• Frameworks we map to that changed: [NIST SP 800-53, HIPAA Privacy Rule, HIPAA Security Rule]
• Removed sources we relied on: [Check list below against your mappings]
• Downstream mapping updates needed: [List]

6. Actions and Owners

7. Approval
Approved by: [Name] Date: [Date]

How to Customize It

Section 2 is critical. If your last assessment was on 11.3.2 or older, that version will soon be unavailable for new objects. Moving to 11.9.0 offers a longer runway before the next mandatory change. If you're mid-assessment on an older version, completing it before March 31, 2027, might be easier. Document which logic applies to you.

Section 3 depends on your product reality. HITRUST added the OWASP Top 10 for Agentic Applications as an authoritative source and a selectable "Agentic AI" factor within the AI Security assessment. Even if you have no agentic features, review whether your vulnerability management controls differ under 11.9.0.

Section 4 is about risk, not panic. The encryption controls were updated for post-quantum cryptography considerations, not immediate changes. For 11.9.0, expect this to be part of your risk assessment and possibly your implementation plan. Document your reasoning. An assessor will want to see that you evaluated it, and "evaluated and deferred with justification" is a valid outcome when documented.

Section 5 prevents mapping surprises. 11.9.0 updated NIST SP 800-53 to Rev. 5.2.0 and refreshed HIPAA Privacy and Security Rule mappings. It removed several sources: APEC Cross-Border Privacy Rules (CBPR), Data Governance Framework, HITRUST De-ID Framework, ISO/IEC 27799:2016, ISO/IEC 29100:2011, and NIST SP 800-53 r4. If any of your internal control mappings or customer commitments reference those, flag them now.

If you also maintain SOC 2 or ISO/IEC 27001, add a row to Section 5 noting which shared controls (cryptography, vulnerability management, supplier risk) are affected, so you update evidence once instead of three times.

Validation Steps

Before circulating the memo, check each of these:

1. Date Check. Confirm the December 31, 2026, creation cutoff and the March 31, 2027, submission deadline against HITRUST's current HAA notices. Deadlines can change.
2. Version Check. Verify your e1 or i1 timeline separately; the relevant version for those assessment types differs from the older r2 versions.
3. Inventory Check. Spot-check three systems from your inventory against Section 3 and three cryptographic implementations against Section 4. If you can't answer the questions for a sample, your inventory isn't ready.
4. Assessor Check. Send the memo to your External Assessor before finalizing. Ask them to confirm the version decision fits their scheduling and your submission window.
5. Evidence Check. Ensure every "Yes" in Sections 3 and 4 points to an artifact: a risk register entry, a cryptographic inventory export, a test report.
6. Approval Check. Get a dated signature. A decision memo without an approver is just an opinion.

Review the memo again at your next scheduled risk assessment or whenever HITRUST issues a new CSF release.