The A1 Security Assessment requirements can only be added to the r2 assessment type.

The A1 Security Assessment factor is an optional module that introduces requirements for evaluating the security and governance of AI-based systems. These requirements are mapped into HITRUST CSF across domains like risk management, monitoring, and governance. Importantly, the A1 factor is not restricted solely to r2 assessments. While r2 provides the most comprehensive assurance model, A1 can also be added to other eligible assessment types such as i1 when the scope involves AI risks. The factor is treated like any other regulatory or organizational factor in MyCSF—its selection generates additional tailored requirement statements. Therefore, the claim that A1 can only be added to r2 is inaccurate. The correct understanding is that A1 can apply to multiple assessment types, depending on scoping decisions.