A 12 week HITRUST readiness plan runs from choosing the assessment and scope in weeks 1 and 2, through a gap review and control fixes in weeks 3 to 9, to evidence collection and assessor handoff in weeks 10 to 12. The weeks are our planning template, and HITRUST does not publish a standard duration.
What the calendar covers, and what it does not
HITRUST describes e1 (43 core controls), i1 (182 control requirements) and r2 (tailored, most comprehensive) assessments, each built on the HITRUST CSF, with work reusable toward a larger assessment. A HITRUST Authorized External Assessor validates the work. This calendar covers your readiness effort up to the point you engage assessment work. We found no sourced durations for assessor validation or HITRUST's own review, so we give none. Ask your assessor for their timeline and add it to yours.
The plan fits an e1 or i1 for a small or mid-size environment. An r2 with a broad, tailored scope usually needs longer.
Weeks 1 and 2: decide and scope
Pick the assessment type with your sales and security leads, based on what customers ask for. Define the scope: systems, data types, locations and teams. Engage an assessor and a MyCSF account. Name an executive sponsor and a programme lead. List the cloud providers whose certifications you might inherit from.
Output: scope document, assessor engagement, sponsor, owner list.
Weeks 3 and 4: requirement mapping and gap review
Pull the applicable requirement statements from MyCSF. Assign each to an owner. Rate the current state: documented, implemented, evidenced or not. Record gaps in a tracker with priority and effort.
Output: requirement tracker with gaps.
Weeks 5 and 6: governance and people controls
Write or update the policies that the requirements call for: security program, risk management, acceptable use, onboarding and offboarding, awareness training. Complete a risk assessment. Roll out training and collect acknowledgments.
Output: approved policies, risk register, training records.
Weeks 7 and 8: technical controls
Close technical gaps: MFA and access reviews, configuration baselines, vulnerability scanning and patching, logging and monitoring, encryption, backup and restore tests, change management enforcement. Prioritise items that appear across many requirements.
Output: configured systems with exports and dated evidence.
Week 9: third parties and continuity
Complete the vendor inventory with risk tiers and collect assessment evidence. Document incident response and continuity plans and run a tabletop exercise. Capture inherited control letters from cloud providers.
Output: vendor register, incident plan with exercise notes, inheritance records.
Week 10: evidence assembly
Collect evidence per requirement into a structured library with consistent file names, dates and owners. Check that each artefact proves the requirement as written. Remove stale or contradictory items.
Output: evidence library and index.
Week 11: internal review
Run a mock review: someone outside the control owner picks requirements at random and asks for proof. Fix gaps and re-test. Escalate anything that cannot be fixed before handoff, and decide whether to adjust scope.
Output: review log, remediation tickets closed.
Week 12: handoff
Complete the MyCSF inputs, confirm scope boundaries with the assessor and hand over the evidence library. Agree the validation timeline and contact points.
Output: submission package and assessor schedule.
Risks to the calendar
Scope creep, slow vendor responses, controls that depend on procurement or engineering sprints, and people who change roles mid-plan. Build a one week buffer and review the tracker every week.
What to do
- Choose assessment type and scope before any control work.
- Book the assessor early.
- Build the requirement tracker in week 3 and keep it alive.
- Fix cross-cutting technical controls first.
- Keep evidence dated and labelled as you go.
- Run the mock review in week 11, not later.
- Ask the assessor for their timeline and fold it into the plan.
Quick check
How long does HITRUST certification take overall?
We did not find a sourced figure. Readiness effort depends on your starting point, and assessor validation and HITRUST review add time. Ask your assessor.
Can I start with e1 and move up?
HITRUST says its assessments are traversable, so work from an e1 or i1 can be applied toward a more comprehensive one.
How Safeguard helps automate this
Weeks 7 to 10 are where teams burn time collecting and re-collecting proof. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously after handoff, which saves your team time for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. HITRUST and its external assessors decide the outcome; Safeguard does not certify you or guarantee a pass. Book a call.
Sources
- HITRUST: assessments and certifications
- HITRUST e1, i1 and r2 pages
Last reviewed: 18 October 2026.
