HITRUST is a framework and assessment program for information security. Its three assessment types, e1, i1 and r2, differ in depth and validity period. This glossary defines the terms you meet when you scope one, in plain words, based on HITRUST's own materials.
The assessment types
e1 (Essentials). A one year certification that gives entry level assurance on basic cyber hygiene. HITRUST pages cite either 43 or 44 requirements depending on the document, so check the current count.
i1 (Implemented). A one year certification for leading practices against a broader range of active threats. It has 182 requirements.
r2 (Risk-based). A two year certification with the highest assurance. The requirement set is tailored to your risk factors, so there is no fixed count.
Source for all three: HITRUST assessments and certifications.
The vocabulary
Assessed entity. The organization being assessed.
MyCSF. HITRUST's tool. For an r2, you start in MyCSF by completing a risk-based scoping questionnaire. That generates a customized set of control references and requirement statements.
Requirement statement. A specific control expectation you must show you meet. Think of it as one line of the test.
HITRUST CSF. The control framework behind the assessments. It draws on other authoritative sources.
Scoping. Deciding which systems, locations and business units are in the assessment. A small, well drawn scope costs less and is easier to defend.
Traversable. HITRUST's word for the way the assessments nest. All e1 requirements are in the i1, and all i1 requirements are in the r2 baseline. Work done for one counts toward the next.
Certification. HITRUST's validated outcome after an assessment passes its review. It is issued by HITRUST, not by a software tool.
Evidence. Proof that a control exists and operates: configuration exports, logs, policies, training records.
Authorized external assessor. The outside firm that tests your evidence. Confirm the current term and role on HITRUST's site.
What do the terms look like in a real scoping call?
A customer writes that they need a HITRUST report. You ask which assessment type, which systems, and by when. They answer r2, the hosted platform only, next quarter. Now you know the requirement set will be tailored through scoping, the scope is one platform, and the evidence window starts today. Each answer uses one term from this list, which is the point of learning them.
How do the terms fit together?
You pick an assessment type, define scope, answer the scoping questionnaire if you are doing an r2, and receive requirement statements. You gather evidence for each one, an assessor tests it, and HITRUST reviews the result.
The pieces to check at the start are scope and type. Most surprises come from a scope that was too wide or an assessment type that does not match what a customer asked for. If a customer demands "HITRUST," ask which type, because e1, i1 and r2 are not interchangeable.
What to do
- Ask the requesting customer which assessment type they accept.
- Define scope in writing: systems, data and locations.
- List the requirement statements and map each to a system of record.
- Choose an owner for each human artifact such as policies and training.
- Plan evidence collection on a schedule, not at the end.
- Check current requirement counts and terms on HITRUST's site before quoting them.
Quick check
What is the difference between i1 and r2?
The i1 is a one year certification with a fixed set of 182 requirements. The r2 is a two year, risk based assessment with a tailored set.
Does software certify me for HITRUST?
No. Tools can help collect evidence. Certification comes from HITRUST after an assessment.
Sources
Last reviewed: 18 October 2026.
