Expect an assessor to ask for three kinds of evidence for each control: the written policy or standard, proof the control is implemented in your systems, and records that it keeps operating. The depth rises from the e1 to the i1 to the r2. Pick your assessment first, then collect evidence against its control set.
This post explains the program. It makes no claim that Safeguard or any customer holds a HITRUST certification, and we do not certify anyone.
What are the HITRUST assessments?
According to HITRUST's own page, it offers a portfolio of cybersecurity assessments and certifications: the e1, i1 and r2, plus an AI Security Assessment and Certification. It describes the e1 as foundational assurance with 43 core controls for low risk entities, and the i1 as threat-adaptive with 182 controls focused on leading practices. The r2 is described as its highest level of tailored, risk-based assurance for complex environments.
All of them are built on the HITRUST Framework, called the HITRUST CSF, and HITRUST says they are traversable: work from an e1 or i1 can be applied toward a more comprehensive i1 or r2. Treat those figures as HITRUST's description and check the current page, since control counts and program rules change.
What does "evidence" mean in practice?
We did not read HITRUST's assessor guidance for this post. What follows is the general shape that audit programs share, so confirm specifics against the requirement statements in your own assessment.
Documents. Policies, standards and procedures with owners, approval dates and review history. A policy that says "we encrypt data at rest" is the claim, not the proof.
Configuration proof. Screenshots or exports that show a setting is on: encryption flags, MFA enforcement, logging destinations, backup schedules. Exports with timestamps beat screenshots, because they are harder to dispute.
Operating records. Tickets for access reviews, change approvals, vulnerability remediation and incident handling, dated across the assessment period. This is where many teams stumble. They have the control but cannot show it ran last quarter.
Population samples. Assessors often pick a sample from a list, such as new hires or production changes, and ask for the record for each. You need the full list to exist and be correct before they choose.
Third party assurance. Reports or attestations from vendors that handle in-scope data, plus your own review of them.
Which controls cause the most evidence work?
Those that depend on people doing recurring things: access reviews, security awareness training, vulnerability management, vendor reviews and incident exercises. Technical settings are easy once; recurring tasks are easy only if scheduled.
For software supply chain controls, keep an inventory of components for in-scope applications, scan results with dates, a record of how findings were prioritized and fixed, and the policy that sets timelines. An SBOM per release plus dated scan output is the kind of artifact that answers several questions at once.
How do you avoid collecting twice?
Map each piece of evidence to every framework it supports. A dated access review serves HITRUST, SOC 2 and ISO 27001 alike. Store it once with metadata: control, system, date range, owner. Tooling that connects to your systems and pulls configuration and records on a schedule can cut the manual effort, though an assessor still decides what is sufficient.
What to do
- Choose the assessment (e1, i1 or r2) with your customers' requirements in hand.
- Define scope: systems, locations, data and the assessment period.
- Pull the requirement statements for your assessment and make a control by control evidence list.
- Assign an owner and a due date for each piece of evidence.
- Schedule recurring tasks, such as access reviews, with calendar reminders and tickets.
- Prefer system exports with timestamps over screenshots.
- Run an internal dry run, sampling records the way an assessor would.
- Store evidence once with tags that link it to each framework.
Quick check
How many controls are in the e1 and i1?
HITRUST's page describes 43 core controls for the e1 and 182 for the i1. Confirm on the current page.
Can e1 work count toward a later r2?
HITRUST says its assessments are traversable, so work from earlier assessments can apply to more comprehensive ones.
Sources
- HITRUST assessments and certifications, fetched 18 October 2026
- Software Bill of Materials (SBOM), CISA, fetched 18 October 2026
Last reviewed: 18 October 2026.
