Microsoft Purview - Compliance Score (Part 3) - HITRUST
Published Oct 11 2022 12:11 PM 1,153 Views
Microsoft

markus-winkler-UsG7z9TAZdc-unsplash.jpg

 

Before we start, please not that if you want to see a table of contents for all the sections of this blog and their various Purview topics, you can locate the in the following link:

Microsoft Purview - Compliance Score (Part 1) - Overview

 

 

Disclaimer

This document is not meant to replace any official documentation, including those found at docs.microsoft.com.  Those documents are continually updated and maintained by Microsoft Corporation.  If there is a discrepancy between this document and what you find in the Compliance User Interface (UI) or inside of a reference in docs.microsoft.com, you should always defer to that official documentation and contact your Microsoft Account team as needed.  Links to the docs.microsoft.com data will be referenced both in the document steps as well as in the appendix.

 

All of the following steps should be done with test data, and where possible, testing should be performed in a test environment.  Testing should never be performed against production data.

 

Target Audience

This blog series is aimed at Security and Compliance officers who need to understand how the Microsoft Purview Compliance Manager assessments can help them meet their regulatory and certification needs.

 

Document Scope

This document will only be discussing the assessment specific to HITRUST and which Purview components are needed to meet those requirements in the assessment and its associated certification.

 

Out-of-Scope

This document does not cover any other aspect of Microsoft E5 Purview, including:

  • Compliance Manager (configuration)
  • Data Classification
  • Information Protection
  • Data Protection Loss (DLP) for Exchange, OneDrive, Devices
  • Data Lifecycle Management (retention and disposal)
  • Records Management (retention and disposal)
  • eDiscovery
  • Insider Risk Management (IRM)
  • Priva
  • Advanced Audit
  • Microsoft Cloud App Security (MCAS)
  • Information Barriers
  • Communications Compliance
  • Licensing

For details on licensing (ie. which components and functions of Purview are in E3 vs E5) you will need to contact your Microsoft Security Specialist, Account Manager, or certified partner.

 

We will not be walking through the HITRUST assessment step-by-step.  For more information on running an assessment in Compliance Manager, you should reference the corresponding documentation listed in the Appendix and Links section below.

 

Overview of Document

We will be walking through how the HITRUST assessment can be leveraged to meet HITRUST certification and provide quantifiable results for meeting that certification.

  • What is HITRUST Certification?
  • What is the Compliance Manager HITRUST assessment?
  • Process of taking assessment information and score and narrowing to Purview related solutions
  • HITRUST assessment details (Control Family, Purview relevant olutions breakdown and Purview Compliance Score)

 

Use Case

Looking at a HITRUST assessment at a high level

 

 

Definitions

  • Actions– the things that need to be done to mark a Control as completed and
  • Assessments – these help you implement data protection controls specified by compliance, security, privacy, and data protection standards, regulations, and laws. Assessments include actions that have been taken by Microsoft to protect your data, and they're completed when you take action to implement the controls included in the assessment.
  • Assessment Templates – these templates track compliance with over 300 industry and government regulations around the world.
  • Compliance Score - Compliance Manager awards you points for completing improvement actions taken to comply with a regulation, standard, or policy, and combines those points into an overall compliance score. Each action has a different impact on your score depending on the potential risks involved. Your compliance score can help prioritize which action to focus on to improve your overall compliance posture.  You receive an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance.
  • Controls – the various requirements in your tenant that must be met to meet a part of an assessment
  • Control Family – a grouping of Controls
  • Microsoft Actions – These are actions that Microsoft has performed in side of your tenant to help it meet a specific assessment.
  • Progress – each assessment has a progress chart to help you visualize the progress you are making to meet the requirements of the assessment
  • Your Improvement Actions – These are actions that you and your organization  must perform to  meet a specific assessment.

 

 

 

Notes

It is highly recommended that you run your own HITRUST assessment to see the following information in your own Tenant.

 

Pre-requisites

It is highly recommended that you run your own HITRUST assessment to see the following information in your own Tenant.

 

 

What is HITRUST certification?

Here is the definition listed in Microsoft Purview Compliance Manager.

 

 

“The HITRUST CSF is a single harmonized framework based on recognized security, privacy and compliance standards, regulations and leading practices. Established in collaboration with private sector, government, technology and information privacy and security leaders, the HITRUST CSF can be used by any organization that creates, accesses, stores, or exchanges sensitive information. This template reflects the update from V9.6.”

 

You can also find more information at the HITRUST official website, listed in the Appendix and Links section below.

 

 

What is the Compliance Manager HITRUST assessment?

This is the official Microsoft tool that scans your tenant and compares it to the HITRUST CSF.  It then provides a report and workflow on how to meet this certification.

 

 

Narrowing HITRUST to applicable Purview tools

 

We narrow the scope of from All HITRUST Control Families (21x) the Assessment runs to just the Compliance applicable HITRUST Control Families (6x).  Then we can take those tactical Control Families and leverage the applicable Microsoft Purview tools that, when applied, can help you meet these Control Families. 

 

  • Here is one way to view this
    • All Control Families (21x) -> Compliance applicable Control Families (6x) -> applicable Microsoft Purview tools

 

  • This graphic shows another way to visualize this.

 

James_Havens_0-1661973456879.png

 

HITRUST Assessment details

Let us look at the details of the HITRUST assessment as they related to Microsoft Compliance Purview solutions and your Compliance Score for your Microsoft tenant.

 

All Control Families (21x)

The HITRUST assessment will report back on ALL the Control Families that are part of the HITRUST certification.

 

James_Havens_0-1661973587943.png

 

 

 

Compliance applicable All Control Families (6x)

From a Purview perspective, here are the 6 Control Families that are applicable to HITRUST certification workloads.

 

 

James_Havens_1-1661973587954.png

 

 

 

Relevant Purview Solutions (12x)

Now that you know which Control Families are relevant to HITRUST certification, here are the Purview solutions that are part will help you meet those certification needs.

 

 

James_Havens_2-1661973587966.png

 

 

 

Purview Compliance Score

Let us look at a diagram the HITRUST assessment’s points that it applies 1) HITRUST Controls over all, 2) points that can specifically be addressed by Purview related tools, and 3) then the percentage of the HITRUST assessment points covered by implementing the Purview tools.

 

James_Havens_3-1661973587986.png

 

 

 

Appendix and Links

HITRUST Alliance | HITRUST CSF | Information Risk Management

 

Microsoft Purview Compliance Manager - Microsoft Purview (compliance) | Microsoft Docs

 

Microsoft Purview- Paint By Numbers Series (Part 0) - Overview - Microsoft Tech Community

 

Compliance score calculation - Microsoft Purview (compliance) | Microsoft Learn

 

Working with improvement actions in Microsoft Purview Compliance Manager - Microsoft Purview (compli...

Co-Authors
Version history
Last update:
‎Oct 11 2022 12:34 PM
Updated by: