When partially inheriting a requirement statement score from an external cloud service provider, the weighting...

The weighting of partially inherited scores in HITRUST is determined by HITRUST’s methodology, not by mutual agreement between the assessed entity and service provider.

Organizations may identify which portions of a requirement are inherited vs. managed internally, but the actual scoring mechanics are controlled by the HITRUST CSF Assurance methodology to ensure consistency.

Extract Reference (HITRUST CSF Inheritance Guidance [0190]):

Weighting for partial inheritance is calculated using HITRUST’s scoring methodology, not negotiated between entities.