True or False: An in-scope control that did not operate during the review period can be marked as N/A.

True or False: An in-scope control that did not operate during the review period can be marked as N/A.

• A. True
• B. False
• C. It depends on the control
• D. Only if documented

Answer: (B)

The assertion that an in-scope control that did not operate during the review period can be marked as N/A is incorrect. In the context of HITRUST and its Common Security Framework, controls are evaluated for their effectiveness during the review period. If a control was supposed to be in operation but was not, it typically does not qualify for a 'Not Applicable' (N/A) designation. Instead, the control should be marked as 'Not Effective' or might require a further evaluation to determine the reasons why it was inactive and how that impacts compliance and security posture. This approach ensures that stakeholders are aware of any deficiencies in controls that should be functioning, thereby promoting accountability and transparency in the assessment process. By maintaining all in-scope controls in the review—even those that did not operate—organizations can better identify gaps in their security frameworks and address them appropriately.

The assertion that an in-scope control that did not operate during the review period can be marked as N/A is incorrect. In the context of HITRUST and its Common Security Framework, controls are evaluated for their effectiveness during the review period. If a control was supposed to be in operation but was not, it typically does not qualify for a 'Not Applicable' (N/A) designation. Instead, the control should be marked as 'Not Effective' or might require a further evaluation to determine the reasons why it was inactive and how that impacts compliance and security posture.

This approach ensures that stakeholders are aware of any deficiencies in controls that should be functioning, thereby promoting accountability and transparency in the assessment process. By maintaining all in-scope controls in the review—even those that did not operate—organizations can better identify gaps in their security frameworks and address them appropriately.