You can do most HITRUST preparation yourself, but not the certification. The sequence is: choose between the e1, i1 and r2 assessments, define scope, assess against the HITRUST framework, close gaps, collect evidence, then undergo a validated assessment with an approved external assessor. Start by picking the lowest assessment that satisfies your customers.
Which HITRUST assessment should you pick first?
HITRUST's public page describes three core assessments, all built on the HITRUST framework, so work from one can carry into a larger one.
- e1: a one year validated assessment based on 43 foundational controls. HITRUST positions it for startups and organisations with limited risk profiles.
- i1: a one year validated assessment with more controls (182, per HITRUST's FAQ), for organisations with established programmes that want to show leading practices.
- r2: a two year validated assessment for organisations that need to show alignment with authoritative sources such as HIPAA and the NIST Cybersecurity Framework, with tailoring based on risk factors.
Ask your customers or contracts what they require before you choose. A buyer that asks for r2 will not accept e1, and over buying costs you months.
What do you do in what order?
Step 1, set the target. Read the contract or security questionnaire that triggered this. Note the assessment type named, the systems in scope and the date you need a result.
Step 2, scope the assessment. Choose the system or product, the supporting infrastructure, the people, the facilities and the third parties that process the data. A small, well defined scope is easier to defend than a vague one. Record what is out of scope and why.
Step 3, run a readiness pass. Walk through the control requirements for your assessment type and mark each as implemented, partly implemented or missing. Be honest here. This is private work, and honesty now is cheaper than a failed validation later.
Step 4, assign owners. Every control gets one accountable person. Engineering, IT, HR, legal and facilities each hold a set.
Step 5, close gaps in priority order. Start with controls that need long lead time: policies that need leadership sign off, training cycles, vendor agreements and technical changes such as logging and multi factor authentication.
Step 6, build the evidence set. For each control, keep what proves it works: configuration exports, tickets, access reviews, training records, meeting minutes and signed policies. HITRUST validated assessments are evidence based, so an unproven control will not count.
Step 7, choose an assessor. HITRUST describes external assessors as organisations it has approved to perform assessments. You select one, agree the scope, and they validate your self assessment. Ask each assessor how they handle evidence collection, and which controls they find hardest.
Step 8, respond to the validation. Expect questions and requests for more evidence. Answer quickly and keep a log.
HITRUST's page also mentions that organisations can inherit controls from certified cloud providers. Check the exact inheritance rules before you rely on it.
What can you realistically do alone?
Scoping, gap assessment, policy writing, technical hardening, evidence gathering and training are all in your hands. The validated assessment and the final certification decision are not. Plan for that dependency in your timeline, and do not promise customers a date until the assessor confirms theirs.
What mistakes are common?
- Choosing r2 when e1 or i1 would satisfy the customer.
- Scoping the whole company when one product would do.
- Treating policies as the finish line. The assessment tests whether controls operate.
- Leaving vendor management until last, when contracts take weeks.
- Starting evidence collection after the assessor arrives.
What to do
- Confirm the required assessment type with the customer in writing.
- Write a one page scope statement and have leadership approve it.
- Run a readiness pass and rank gaps by lead time.
- Assign owners and set weekly check ins.
- Collect evidence as you go, in one shared location with a naming rule.
- Shortlist approved external assessors and compare their processes.
- Hold a mock walkthrough of five random controls before the assessment begins.
Quick check
Can we self certify for HITRUST?
No. HITRUST describes e1, i1 and r2 as validated assessments performed with an external assessor. You can prepare yourself, but the certification depends on that validation.
Does work on an e1 help with an r2 later?
According to HITRUST's page, the assessments are built on the same framework so work done earlier can be applied to a more comprehensive assessment. Confirm the details with your assessor.
Sources
- HITRUST, Assessments and certifications, fetched 18 October 2026. Control counts and assessment descriptions come from this page; check it for current figures.
How Safeguard helps automate this
The slow part of a HITRUST effort is evidence: hundreds of small proofs that controls operate. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and continues between assessments. Technical evidence comes from real code and dependencies, using scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies and other findings; it is off by default, every category starts on Manual, and you choose which categories run automatically and with what approval. Safeguard helps you prepare and keep evidence ready. The validated assessment is done by an independent approved assessor, and Safeguard does not certify you. Book a call to talk it through.
Last reviewed: 18 October 2026.
