HITRUST for a startup: what to do in the first 90 days

In your first 90 days toward HITRUST, decide which assessment fits (e1, i1 or r2), fix the scope, run a gap review against its requirements, and start collecting evidence. Most startups begin with the smaller assessments and move up as customers demand it.

This explains the framework. HITRUST certification is issued by HITRUST after an external assessor validates your results, not by any software vendor.

Which assessment should you pick?

HITRUST offers three levels that build on each other. One summary from the Cloud Security Alliance gives these figures; counts change between versions, so confirm them on HITRUST's site:

• e1: 44 requirements as of that summary, basic assurance, valid one year.
• i1: 182 requirements, moderate assurance, valid one year.
• r2: over 200 requirements, highest assurance, valid two years with an interim review.

HITRUST's own advisory confirms the i1 is valid for one year with a full reassessment each year, and that the r2 is valid for two years and can be bridged with a HITRUST Bridge Certificate while the i1 cannot. Both have an assessor fieldwork window capped at 90 days.

That cap is a useful reminder. The 90 days in this post are your preparation. The assessor's clock is separate and starts later.

The e1 is described as suited to startups starting out, but note the summary's caution: the e1 does not cover compliance with laws such as HIPAA. Ask your customers which assessment their security team accepts before you choose. Buying an assessment nobody asked for is the common mistake.

Days 1 to 30: decide and scope

1. Ask your three largest prospects or customers which HITRUST level they require, or whether another framework such as SOC 2 would do.
2. Choose the level. Check that the tier fits the data you handle.
3. Define scope: the products, systems, locations and teams in the assessment. A smaller, well-defined scope is easier to evidence.
4. Name an executive sponsor and a day-to-day owner.
5. Inventory systems, vendors and data flows in scope.

Days 31 to 60: find the gaps

1. Map your current controls against the requirements of your chosen level.
2. Mark each requirement as met with evidence, met without evidence, partly met or not met.
3. Rank the gaps by effort and by whether a customer will notice them.
4. Fix policy and procedure gaps first, since they are cheapest.
5. Open tickets for technical gaps: MFA coverage, logging, encryption, vulnerability management, access reviews.

Days 61 to 90: build evidence and pick an assessor

1. Start collecting evidence on a schedule: screenshots are weak, system exports with dates are better. Set owners and calendar reminders.
2. Run a short internal review of your evidence against the requirements.
3. Select an external assessor and agree the timeline. Ask what they need from you and in what format.
4. Choose a start date that follows your evidence readiness, not your sales deadline.

What do startups get wrong?

They scope too broadly, then drown in evidence. They treat policies as the finish line when the assessor tests whether practice matches. And they start the clock before the evidence habit exists, so the 90 day fieldwork cap arrives with half the proof missing.

Where can software help?

Compliance automation can collect system evidence on a schedule and keep it in one place, which reduces the manual part of the work. It does not issue a certification, decide your scope, or replace the external assessor.

What to do

1. Confirm the level your customers will accept.
2. Fix scope in writing.
3. Run the gap review and rank the results.
4. Close policy gaps in the first 60 days.
5. Set up scheduled evidence collection.
6. Choose an assessor and a realistic start date.
7. Rehearse one evidence request end to end.

Quick check

Sources

• HITRUST advisory HAA 2021-012: i1 introduction and r2 enhancements
• Cloud Security Alliance: HITRUST CSF assessments e1, i1, r2

Last reviewed: 18 October 2026.