What is the minimum number of days a remediated control must operate before re-testing in an r2 assessment?

What is the minimum number of days a remediated control must operate before re-testing in an r2 assessment?

• A. 30 days
• B. 60 days for Policy/Procedure and 90 days for Implementation
• C. 90 days for both Policy/Procedure and Implementation
• D. 120 days

Answer: (B)

In the context of HITRUST assessments, particularly for the r2 assessment, there are specific stipulations regarding the remediated controls and the timeline for re-testing them. The correct answer indicates that there are different requirements depending on the type of control being assessed. For Policies and Procedures, there is a requirement of a 60-day operational period before re-testing can occur. This time frame allows for sufficient observation and evidence collection as the policies and procedures are put into practice. It's important to note that just having a policy or procedure is not enough; it must be adequately tested to ensure it operates effectively within the framework of an organization's security practices. On the other hand, for Implementation controls—which pertain more to the actual technical or physical implementations of security measures—the requirement extends to 90 days. This longer duration acknowledges the complexities inherent in technological implementations and the need for a longer observation period to fully assess their effectiveness and identify any potential issues that may arise. This differentiated approach helps organizations ensure that both their policies are not just written but actively followed, and that implemented controls operate correctly in the intended environment before they're subjected to re-testing in assessments.

In the context of HITRUST assessments, particularly for the r2 assessment, there are specific stipulations regarding the remediated controls and the timeline for re-testing them. The correct answer indicates that there are different requirements depending on the type of control being assessed.

For Policies and Procedures, there is a requirement of a 60-day operational period before re-testing can occur. This time frame allows for sufficient observation and evidence collection as the policies and procedures are put into practice. It's important to note that just having a policy or procedure is not enough; it must be adequately tested to ensure it operates effectively within the framework of an organization's security practices.

On the other hand, for Implementation controls—which pertain more to the actual technical or physical implementations of security measures—the requirement extends to 90 days. This longer duration acknowledges the complexities inherent in technological implementations and the need for a longer observation period to fully assess their effectiveness and identify any potential issues that may arise.

This differentiated approach helps organizations ensure that both their policies are not just written but actively followed, and that implemented controls operate correctly in the intended environment before they're subjected to re-testing in assessments.