A Corrective Action Plan (CAP) is used when a requirement statement is not fully satisfied. HITRUST requires specific information to ensure the CAP is actionable and trackable:
Responsible party # assigns accountability.
Status # indicates if the CAP is open, in progress, or closed.
Steps for remediation # outlines actions that will be taken.
Estimated completion date # provides a timeline for closure.
The amount of capital/expense is not a required element in HITRUST documentation, as CAPs focus on remediation planning and accountability, not budgeting.
Extract Reference (HITRUST CSF Assurance Program, CCSFP Guide, CAP Documentation [0064]):
Each CAP must include responsible individual(s), remediation steps, current status, and estimated completion date to be valid in MyCSF.