HITRUST has announced IRIDX, an information risk ratings company that establishes and governs standardized methods for measuring residual information risk and estimating related financial exposure. IRIDX turns existing assurance and risk evidence into comparable, explainable measures that give enterprises, boards, underwriters and regulators a common basis for information risk decisions.
Standardized risk measures and modeled financial exposure connect third-party evaluation with enterprise governance and insurance underwriting.
Organizations have access to extensive assurance and risk evidence, including assessments, certifications, questionnaires, telemetry and external risk signals, but lack consistent way to evaluate it efficiently at scale and translate into comparable measures of residual information risk. This limits ability to assess exposure against risk appetite and incorporate results into broader risk-management program.
"You cannot govern what you cannot consistently measure," said Daniel Nutkis, Founder and Executive Chairman, HITRUST and Founder of IRIDX. "Financial markets rely on standardized measures of credit risk because consequential decisions require a common basis for comparison. Information risk has lacked that same foundation. IRIDX brings measurement discipline to information risk so organizations can compare residual risk, understand financial exposure, govern what they accept and make informed decisions about what they reduce, retain or transfer."
IRIDX establishes common measurement by giving organizations standardized basis for interpreting assurance evidence, comparing residual risk and connecting risk to financial exposure. That common language allows risk, security, finance, executive and board stakeholders to work from consistent measures.
IRIDX's Evidence Intelligence process evaluates assessments, certifications, questionnaires, telemetry and external signals to determine what each input demonstrates and how reliably it supports risk determination. These evaluations determine how evidence contributes to residual-risk measure. IRIDX delivers standardized measures and decision support through IRIDX Score, Information Risk Financial Exposure, and governance and benchmarking tools.
The IRIDX Score measures residual information risk and explains factors driving result, helping teams prioritize mitigation. An evidence-confidence indicator helps distinguish control weaknesses from evidence gaps or uncertainty. Authoritative Alignment Scores show demonstrated alignment and gaps against regulatory, standards, supervisory and AI governance requirements.
IRFE combines IRIDX residual-risk and evidence-confidence signals with relationship-specific service, contract and business-impact information. It estimates scenario-based Low / Base / High range of modeled gross financial exposure for defined relationship, before insurance, indemnity, contractual recovery or other transfer mechanisms. Visible assumptions and loss drivers make each estimate traceable to business context.
"Third-party information risk decisions have consequences for the whole business," said Gregory Webb, Chief Executive Officer of HITRUST. "IRIDX bridges the gap between cybersecurity risk and business decision-making, giving executives and boards a consistent, defensible basis to understand their financial exposure, prioritize risk reduction and make informed decisions about what risk to accept, retain or transfer."
"Evaluating cyber risk is of utmost importance in every M&A transaction and for any board to properly exercise its fiduciary obligations. Clients need to understand not just what a vendor has agreed to, but what exposure the business may still carry. That means considering residual information risk and potential financial and reputational exposure alongside liability limits, indemnities and insurance," said Mark Solomon, Managing Partner of the Dallas office of Katten Muchin Rosenman. "The value we see in IRIDX and IRFE is a more consistent basis for negotiating protections, deciding what risk to accept and documenting why. That matters both at the negotiating table and in the boardroom."
Management and boards can compare exposure against risk appetite and approved thresholds, track proportion of vendors within tolerance, and identify material exceptions and concentrations across vendors, services and shared dependencies. Portfolio views bring measures together to support trend analysis and accountability.
IRIDX connects risk measurement and financial exposure to support underwriting and enable risk transfer for specific third-party relationships or contracts. Enterprises and insurance brokers can compare IRFE estimates with relevant insurance coverage and contractual recovery provisions to inform decisions. Underwriters can use IRIDX Score, evidence confidence and IRFE to inform decisions about specific relationship.
Comparative review found median analyst review time decreased by 89%, from 5.3 hours to 35 minutes, median elapsed time from evidence submission to completed risk determination decreased by 99.8%, from 14 days to 35 minutes, and median analyst labor cost saving up to 80% per review.
About IRIDX
IRIDX, a HITRUST Company, is an information risk ratings company that develops and governs standardized methods and measures for residual information risk and related financial exposure. Its measures support third-party information risk management, enterprise governance, benchmarking, insurance underwriting and risk transfer. IRIDX and HITRUST are separate companies that share a common founder, Daniel Nutkis; IRIDX governs its methodologies and scoring independently of HITRUST.
About HITRUST
HITRUST is the industry leader in cybersecurity assurance, cyber risk management and ecosystem trust. HITRUST CSF harmonizes more than 70 authoritative information security, privacy, and AI control standards and frameworks, continuously adapted to keep pace with the latest threats, into the gold-standard cybersecurity framework. Defensible assurance is delivered by independent validation through over 100 assessor partners, centralized quality control, standardized certification and reporting, and a powerful platform. Organizations across industries use HITRUST for third-party risk management, cyber risk management, information protection, digital trust, and compliance. According to HITRUST's 2026 Trust Report, 99.62% of HITRUST-certified environments did not report a breach in 2025. For nearly 20 years, HITRUST has set the standard for trusted cybersecurity, enabling teams to manage and reduce risk with consistency and efficiency at scale so organizations can operate confidently and securely
