// ToolkitHITRUST.jsx — Verigo Global: HITRUST CSF implementation toolkit page const { V: TV, MAXW: TMW, FONT: TFT } = window; /* ── BREADCRUMB ──────────────────────────────────────────── */ const HtCrumb = ({ onNav }) => (
/ / HITRUST Toolkit
); const htCrumbBtn = { background: 'none', border: 'none', cursor: 'pointer', color: '#7A7A8A', fontSize: 13, fontWeight: 600, padding: 0, fontFamily: "'DM Sans', system-ui, sans-serif" }; /* ── HERO ────────────────────────────────────────────────── */ const HtHero = ({ onNav }) => (
Healthcare Trust HITRUST CSF · e1 · i1 · r2

The HITRUST toolkit, ready to deploy.

A complete, practitioner-maintained document set — 20 policies, 16 procedures, and all 147 CSF control reference templates across the 14 categories — tailored to your scope so you build a certifiable program without starting from a blank page.

onNav('evaluation')}>Start the readiness evaluation document.getElementById('downloads')?.scrollIntoView({ behavior: 'smooth', block: 'start' })}>See what's inside
Inside the toolkit
{[['doc', '20', 'Approval-ready policies'], ['file', '16', 'Operational procedures'], ['layers', '147', 'CSF control reference templates'], ['clipboard', '180+', 'Documents, maturity & evidence']].map(([ic, n, l], i) => (
{n}
{l}
))}
); /* ── OVERVIEW ────────────────────────────────────────────── */ const HtOverview = () => (
Overview

One framework that harmonizes them all — pre-built and tailored.

The Verigo HITRUST toolkit is the document backbone of a certifiable CSF program. The HITRUST CSF harmonizes HIPAA, ISO 27001, NIST, and PCI into one prescriptive, scalable framework — and this toolkit ships implementation templates for every one of its 147 control references.

Each artefact is maintained by senior practitioners and tailored to your scope and assessment type — then embedded into how you operate, the Compliance by Design way, so the evidence MyCSF needs is produced by the process itself.

{[ ['compass', 'Tailored to your factors', 'Every policy and control is shaped to your organizational, system, and regulatory factors — not a one-size-fits-all template dump.'], ['activity', 'Maturity-model ready', 'Each control reference is built around the CSF maturity levels — policy, process, and implemented — so scoring is structured from day one.'], ['network', 'Cross-framework ready', 'Controls are mapped so the same evidence supports HIPAA, ISO 27001, and NIST without duplication.'], ].map(([ic, t, d], i) => (

{t}

{d}

))}
); /* ── COVERAGE ────────────────────────────────────────────── */ const HtCoverage = () => (
Three assessment types
{window.TK_HITRUST.ASSESSMENTS.map((a, i) => { const pop = !!a.popular; return (
{a.id} {pop && Most popular}
{a.reqs} requirements
{a.name.split(' — ')[1]}
{a.assurance} assurance
Valid {a.validity}
); })}
14 CSF control categories · 147 control references
{window.TK_HITRUST.CATS.map((g, i) => (
{g.code}
{g.items.length} refs
))}
); /* ── CONTENTS EXPLORER + GATED DOWNLOADS ─────────────────── */ const HtContents = ({ onDownload, unlocked }) => { const [tab, setTab] = React.useState('policies'); const A = window.TK_HITRUST.ASSETS; const tabs = [['policies', 'Policies', A.policies.count], ['procedures', 'Procedures', A.procedures.count], ['controls', 'Control References', A.controls.count]]; const meta = A[tab]; const renderList = () => { if (tab === 'controls') { return (
{window.TK_HITRUST.CATS.map((g, gi) => (
{g.code} · {g.name} {g.items.length} refs
{g.items.map(([code, title], i) => (
{code} {title}
))}
))}
); } const list = tab === 'policies' ? window.TK_HITRUST.POLICIES : window.TK_HITRUST.PROCEDURES; return (
{list.map(([t, d], i) => (
{String(i + 1).padStart(2, '0')}
{t}
{d}
))}
); }; return (
{tabs.map(([id, label, count]) => ( ))}
{meta.label}
{meta.blurb}
onDownload(tab)} style={{ flexShrink: 0 }}> {unlocked ? `Download PDF · ${meta.count} ${meta.unit}` : `Download PDF (${meta.count} ${meta.unit})`}
{renderList()}
); }; /* ── SAMPLE DOCUMENTS VIEWER ─────────────────────────────── */ const HtSamples = ({ onDownloadSample }) => { const [s, setS] = React.useState('policy'); const tabs = [['policy', 'Policy', 'doc'], ['procedure', 'Procedure', 'file'], ['control', 'Control reference', 'layers'], ['checklist', 'Checklist', 'clipboard']]; return (
{tabs.map(([id, label, icon]) => ( ))}
Want the full sample?

Preview the complete package index as a branded PDF — we'll ask for a few details first.

Preview / download sample PDF

Samples are illustrative. Delivered documents are tailored to your organization and branding.

 ); }; const HtDocHeader = ({ docId, title, ver = '2.1', owner }) => (
{docId}

{title}

{[['Classification', 'Confidential'], ['Version', ver], ['Owner', owner], ['Framework', 'HITRUST CSF v11']].map(([k, v], i) => (
{k}
{v}
))}
); const HtDocSection = ({ n, h, children }) => (
{n}{h}
{children}
); const HtSamplePaper = ({ kind }) => { if (kind === 'policy') return (
This policy establishes the requirements for controlling access to systems and covered information on a least-privilege, need-to-know basis, in support of HITRUST CSF control references 01.a–01.c and 01.q. Applies to all workforce members, contractors, and business associates who access organizational systems, applications, and covered information.
  • Access is provisioned through a formal request and approval workflow tied to documented roles.
  • Privileged access is restricted, logged, and reviewed at least quarterly.
  • Multi-factor authentication is enforced for remote and administrative access.
  • Access rights are recertified periodically and revoked promptly on a leaver event.
 Documented as policy, operationalized as process, and verified as implemented — the three CSF maturity levels scored in MyCSF. Reviewed annually or upon significant change. Next review: 12 months from approval.
); if (kind === 'procedure') return (
Define the repeatable steps for granting, modifying, and removing access across the joiner–mover–leaver lifecycle, generating the evidence CSF 01.b expects.
2.0Process steps
{[['1', 'Request raised', 'Manager submits an access request specifying role and systems.'], ['2', 'Approval', 'System owner validates least-privilege and approves or rejects.'], ['3', 'Provision', 'IT Operations creates accounts and assigns role-based entitlements.'], ['4', 'Verify', 'Requester confirms access; evidence logged to the ticket.'], ['5', 'Deprovision', 'On a leaver event, access is revoked promptly and recorded.']].map(([n, t, d], i) => (
{n}
{t}
{d}
))}
Access request tickets, approval logs, and periodic access-review reports are retained for the assessment cycle.
); if (kind === 'control') return (
All users have a unique identifier for their personal use, and a suitable authentication technique substantiates the claimed identity of each user.
{[['Category', '01 · Access Control'], ['Maturity', 'Implemented'], ['Control owner', 'Head of IT Security'], ['Assessment', 'i1 / r2']].map(([k, v], i) => (
{k}
{v}
))}
Unique IDs are issued through the identity provider; MFA is enforced for remote and privileged access; shared and generic accounts are prohibited except where documented and compensated. IdP user export, MFA enrolment report, authentication policy, and a sample of access logs demonstrating unique attribution.
); return (
{[['done', 'Scope and assessment factors defined in MyCSF', 'Scope'], ['done', 'All 14 control categories assigned owners', '00–13'], ['done', 'Policies and procedures mapped to control references', 'Maturity'], ['progress', 'Implemented maturity evidenced for in-scope controls', 'Implemented'], ['progress', 'Quarterly access reviews completed and logged', '01.e'], ['todo', 'Risk assessment current and treatment plan tracked', '03.b'], ['todo', 'External Assessor validation scheduled', 'r2']].map(([st, t, ref], i) => { const map = { done: [TV.purple, 'check', 'Complete'], progress: [TV.orange, 'refresh', 'In progress'], todo: [TV.g300, 'clipboard', 'Outstanding'] }; const [c, ic, lab] = map[st]; return (
{t}
{ref} {lab}
); })}
); }; /* ── PRICING ──────────────────────────────────────────────── */ const HtPricing = ({ onNav }) => { const TIERS = window.TK_HITRUST.TIERS; const baseFmt = window.TK_HITRUST.fmtPrice(window.TK_HITRUST.QUOTE_BASE.price); return (
{TIERS.map((t,i)=>{ const pop=!!t.popular; return (
{pop&&
Most popular
}
{t.name}

{t.tagline}

{(t.features||[]).slice(0,4).map((f,fi)=>(
{f}
))}
); })}
onNav('checkout')}>Build custom package Starts from {baseFmt} · add only what you need · live pricing
); }; /* ── ONLINE EVALUATION PROMO ─────────────────────────────── */ const HtEvalBand = ({ onNav }) => { const steps = [ ['target', 'Pick your assessment type', 'Choose e1, i1, or r2 — your choice tailors the evaluation to exactly the categories and depth that apply.'], ['gauge', 'Get your readiness score', 'An instant maturity score with a gap heat-map across the in-scope CSF categories.'], ['flag', 'See your next steps', 'A prioritized action plan showing which toolkit documents and control references close each gap.'], ]; return (
Online evaluation · assessment-aware

Know where you stand before MyCSF.

Our online HITRUST readiness evaluation scores your current state against the CSF categories for your chosen assessment type — and maps every gap straight to the toolkit documents that close it.

onNav('evaluation')}>Start the evaluation onNav('evaluation')}>See how it works
{steps.map(([ic, t, d], i) => (
{String(i + 1).padStart(2, '0')}

{t}

{d}

))}
); }; /* ── PAGE ────────────────────────────────────────────────── */ const ToolkitHITRUSTPage = ({ onNav }) => { const [modalAsset, setModalAsset] = React.useState(null); const [unlocked, setUnlocked] = React.useState(false); const sessionOk = () => { try { return !!sessionStorage.getItem('verigo_dl_ok'); } catch (e) { return false; } }; React.useEffect(() => { if (sessionOk()) setUnlocked(true); }, []); const onDownload = (asset) => { if (sessionOk()) { window.TK_HITRUST.generatePDF(asset, window.TK_HITRUST.getUser() || {}); } else { setModalAsset(asset); } }; const onModalSubmit = (form) => { window.TK_HITRUST.storeLead(form); try { sessionStorage.setItem('verigo_dl_ok', '1'); } catch (e) {} setUnlocked(true); const asset = modalAsset; setModalAsset(null); setTimeout(() => window.TK_HITRUST.generatePDF(asset, form), 60); }; const A = modalAsset ? window.TK_HITRUST.ASSETS[modalAsset] : null; return (
onDownload('standard')} /> {A && ( setModalAsset(null)} onSubmit={onModalSubmit} /> )}
); }; Object.assign(window, { ToolkitHITRUSTPage });