A HITRUST assessment can answer a large share of a customer security questionnaire, because it gives a structured, assessed set of control answers you can point to. It will not cover every row, especially product-specific or contract-specific questions. Use it as the backbone, then answer the gaps in your own words.
This post explains how the framework is used. Safeguard does not hold or confer a HITRUST certification, and nothing here says it does.
What are the three assessment types?
HITRUST's own comparison lists three assessments. The e1 has 43 controls, is valid for one year and covers foundational cybersecurity, aimed at startups and organisations with limited risk or complexity. The i1 has 182 controls, is valid for one year and addresses leading security practices at a threat-adaptive level. The r2 is valid for two years, is risk based and tailored, and suits organisations that need regulatory alignment such as HIPAA or NIST CSF. HITRUST says work from an e1 or i1 can be applied toward a later i1 or r2.
Pick by what your customers ask for, not by the one that sounds most impressive. Ask three or four large customers which they accept.
How does a report map to questionnaire rows?
Questionnaires tend to cover access control, encryption, logging, vulnerability management, incident response, vendor management and business continuity. Each of those has controls in a HITRUST assessment. Build a mapping table once: questionnaire topic on the left, the assessed control and your evidence on the right. When the next questionnaire arrives, you answer from the table and attach the report or an extract, if your agreement with the assessor allows sharing.
Where does it fall short?
Four common gaps.
- Product specifics. Questions such as "do you support single sign-on for customers" or "where is customer data stored" are about your product, not your organisation's control set.
- Customer-specific requirements. A bank or hospital may ask for contract terms, audit rights or named subprocessors.
- Scope. The assessment covers a defined scope. If a customer's data lives in a system outside it, the report does not speak to that system.
- Time. A report reflects a period. Questionnaire answers about today need current evidence for anything that changed.
How should software supply chain answers be handled?
Questionnaires now include rows on third-party components and development practice. Prepare short, factual answers: how you inventory dependencies, how you scan, how you handle a critical advisory, how you control build access. NIST's Secure Software Development Framework groups such practices into preparing the organisation, protecting the software, producing well-secured software and responding to vulnerabilities, which is a helpful outline for your answers.
How to keep answers consistent
Write each answer once in a shared library, with an owner and a review date. Rewriting from memory produces contradictions between questionnaires, which are the first thing a careful reviewer notices.
What to do
- Ask your top customers which assessment types they accept.
- Build a mapping table from common questionnaire topics to assessed controls and evidence.
- Keep a library of answers with owner, source and review date.
- List the gaps (product, contract, scope) and write standard answers for them.
- Refresh anything older than a quarter before you send it.
- Do not describe the assessment beyond what the report says.
Quick check
Does HITRUST replace a SOC 2 report?
Customers decide what they accept. Some take either. Ask them rather than assuming.
Can we send the full report to every customer?
Check your assessor agreement and your own confidentiality rules. Many teams send a summary or letter and share the full report under an agreement.
Sources
Last reviewed: 18 October 2026.
