HITRUST uses a scoring scale from 0 to 100, with categories for Fully Compliant, Mostly Compliant, Partially Compliant, Somewhat Compliant, and Non-Compliant. A score of37falls into the "Somewhat Compliant" category. This reflects significant weaknesses in Policy, Procedure, or Implementation maturity levels. Such a low score indicates agapthat must be addressed. Depending on whether the control is required for certification, HITRUST may require aCorrective Action Plan (CAP). CAPs are required when certification-critical controls score below thresholds (e.g., Implementation not at 100% where required).
Therefore, a Requirement Statement score of 37 would be treated as agap with a possible required CAP, depending on its criticality within the certification process.
References:HITRUST CSF Scoring Rubric - "Compliance Categories and CAP Triggers"; CCSFP Study Guide - "Requirement Scoring Outcomes."