Information Security Framework Alignment

My org is in the process of standing up an InfoSec program. We are a healthcare provider, have been around for several years, are a fairly decent size (~3500 people), and leverage third parties for nearly all of our technical and application needs.

Requirements have come down from the top to become HITRUST certified, which we are actively working towards. I am, however, having a difficult time identifying a framework to standardize on.

My thought process is utilizing NIST RMF …

cybersecurity framework information information security security security framework