HITRUST cost and timeline are driven mainly by which assessment you pick (e1, i1 or r2), how much of your environment is in scope, and how many gaps you must close before the assessment. This post gives no prices because HITRUST does not publish a rate card on the page I fetched, and quotes vary by scope.
What are the three assessments?
HITRUST's assessments page describes them as follows.
- e1: 43 foundational controls, valid for 1 year. Suited to startups and organisations with limited risk profiles, and it can serve as a step toward i1 or r2.
- i1: 182 control requirements, valid for 1 year. For organisations with mature security programmes that want to demonstrate leading practices. Work toward an i1 can be applied to an r2.
- r2: the highest number of control requirements (the page gives no figure), valid for 2 years. For organisations that must demonstrate compliance with authoritative sources such as HIPAA or the NIST Cybersecurity Framework, or that need controls tailored to other risk factors.
The page does not mention interim assessments for these three, so check HITRUST's current rules for what happens in the second year of an r2.
What drives effort?
Treat this as a planning list, not published HITRUST pricing.
- Assessment type. More control requirements mean more evidence, more testing and more time. The jump from 43 to 182 is large.
- Scope. Every system, location and data flow in scope adds testing. A narrow, well defined scope is the biggest lever you control.
- Starting maturity. Gaps found before the assessment must be fixed first. Policies are quick. Technical changes such as logging, encryption and access control take longer.
- Evidence quality. If evidence is collected on demand from many people, it takes longer than if systems export it routinely.
- Third parties. Controls that depend on a cloud provider or vendor need their evidence too.
- People availability. Assessors need answers from engineering, HR, legal and operations at the same time.
- Your choice of assessor and advisors. Fees and speed differ, so get written scope statements from several.
What affects timeline most?
Two things. First is remediation, because you cannot test controls that are not yet in place. Second is the evidence collection period, which for any assessment with an operating component needs enough time for controls to have run. Ask your assessor how long that must be for your chosen assessment, and write it into the plan.
Which should a startup pick?
Start from what the buyer asks for. If a customer's contract names an r2, an e1 will not satisfy it. If no one has named a level, the page positions e1 for startups with lower complexity and as a step toward i1 or r2, and says i1 work can carry into r2. That reuse is a reason to build controls once and reuse the evidence.
Safeguard does not hold HITRUST certification and cannot grant it. Its compliance automation can help collect evidence for technical controls and map them to frameworks you are working toward.
What to do
- Ask your customers which assessment type they require, in writing.
- Define a narrow scope and document the boundary.
- Run a gap assessment against the chosen control set before engaging an assessor.
- Fix technical gaps first, and write policies in parallel.
- Automate evidence exports where systems allow it.
- Get written quotes and timelines from assessors, with the scope statement attached.
Quick check
Does HITRUST publish fixed prices on its assessments page?
The page I fetched lists controls and validity, not prices. Ask HITRUST or an assessor for a scoped quote.
How long is an r2 valid?
Two years, according to HITRUST. The e1 and i1 are valid for one year.
Sources
Last reviewed: 18 October 2026.
