The HITRUST CSF includes 14 control categories, 49 objectives, and 149 total control specifications (which may contain multiple levels of control components). At least 64 of these control specifications are required to be in place and operating effectively for an organization to become HITRUST certified. HITRUST offers a self-assessment option for organizations looking to conduct an assessment internally; however, organizations are well served to obtain the expertise of a qualified CSF assessor organization, such as Interactive Security, to identify the strengths and weaknesses of their information security program and to make recommendations about how to address any issues.