The Subscriber’s Comments field should be populated with the rationale for any requirement statement marked...

When an organization marks a requirement statement as Not Applicable (N/A) in an assessment, it is mandatory to provide a clear rationale in the Subscriber’s Comments field. This ensures transparency for both external assessors and HITRUST reviewers, demonstrating why the requirement does not apply to the environment or assessment object.

Without a justification, the N/A designation would be incomplete.

Assessors rely on this rationale to validate scope appropriateness.

Extract Reference (HITRUST CSF Assessment Guidance, [0048]):

For requirement statements marked as N/A, the Subscriber’s Comments field must include sufficient rationale explaining the inapplicability of the requirement.

Correct response: True.