When a requirement statement is marked as Not Applicable (N/A) in MyCSF, HITRUST requires the organization to provide a justification. This justification must be entered into the Subscriber Comments field.
The rationale explains why the requirement does not apply to the entity's environment, systems, or data. For example, if a requirement relates to payment card data but the organization does not process credit cards, the Subscriber Comments field should document that no PCI-DSS scope exists. HITRUST QA reviews these justifications to ensure N/As are applied appropriately. Failure to document rationale can result in QA findings or required CAPs. This requirement preserves transparency and prevents misuse of the N/A designation to exclude applicable controls.
References: HITRUST CSF Assurance Program - "N/A Requirements and Justification"; CCSFP Study Guide - "Use of Subscriber Comments."