To get through a HITRUST assessment, choose the right assessment type, set a tight scope, gather evidence per requirement before the assessor arrives, and rehearse the questions they will ask. HITRUST certification is issued after an Authorized External Assessor tests your controls, so your evidence has to hold up to independent testing.
Which assessment do you need?
HITRUST's framework page lists three assessment types built on the HITRUST CSF. The e1 offers foundational assurance with 43 core controls and is valid for one year. The i1 offers threat adaptive assurance with 182 control requirements, valid for one year. The r2 is tailored assurance with the highest level of requirements, valid for two years, and the page does not give a control count. Your customer or regulator usually decides which one you need, so ask them in writing before you spend any time.
How do you scope it?
Scope sets the number of requirements, the systems tested and the evidence volume. Define the in scope business unit, facilities, systems, data types and people, and what lives in the cloud. A smaller, cleaner scope is cheaper to evidence, but it must match what your customer actually relies on, or the report will not satisfy them. Draw a data flow, list every system in the boundary, and note who administers it.
What does the platform do?
HITRUST describes MyCSF as its assessment software, used for analysis, assessment and corrective action plan management. Assessments are guided by an Authorized External Assessor, whom you find through HITRUST. Ask your assessor early how they want evidence packaged and how long review cycles run, because that varies by firm and by assessment.
What evidence do you prepare?
For each requirement in scope, prepare three things: the written policy or procedure, proof it is implemented, and proof that someone checks it works. For example, for access control, keep the policy, a sample of provisioning tickets and an access review sign off. For vulnerability management, keep the standard, scan outputs and remediation tickets with dates.
Evidence rules that save time:
- Name each file with the requirement it supports and the date.
- Prefer system exports over screenshots, and keep the export timestamp.
- Keep evidence for the full period the assessment covers, not a single day.
- Store one authoritative copy; link to it from the platform.
Who should own each requirement?
One named person per requirement, not a team. That person writes the procedure, supplies the evidence and answers the assessor's questions. Back each owner with a deputy so a holiday does not stall a review. Keep a simple owner table with names, requirement ranges and the date each owner last walked through their evidence.
How do you rehearse?
Run a readiness exercise before you engage the external assessor. For a sample of requirements, ask the control owner to explain what they do and show the evidence in under ten minutes, without help. If they cannot, you found the gap while it is cheap. Fix owner knowledge gaps, not just documents.
What happens when something fails?
Expect some requirements to score below target. HITRUST's platform includes corrective action plan management, so treat a gap as a dated action with an owner, not a debate. Do not rewrite a procedure to match a mistake, and do not backfill evidence. Honest gaps with credible plans are easier to defend than polished fiction. Ask HITRUST or your assessor how certification decisions treat gaps for the assessment type you chose, since the framework page we read does not describe it.
What to do
- Ask your customer or regulator which assessment type they require.
- Define scope with a data flow and a system list.
- Choose an Authorized External Assessor and agree on evidence format.
- Assign every in scope requirement an owner.
- Collect policy, implementation proof and check proof for each requirement.
- Run a readiness walkthrough with control owners.
- Fix gaps with dated corrective actions.
- Freeze the evidence set and submit through the platform.
Quick check
How long is each HITRUST assessment valid?
According to HITRUST's framework page, e1 and i1 are valid for one year and r2 for two years.
Can we self-certify?
No. Certification is guided by a HITRUST Authorized External Assessor, per the framework page.
How Safeguard helps automate this
Most HITRUST effort goes into evidence that has to be fresh and complete. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between assessments, giving your team time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability, not just policies. The agent can open tested fix pull requests for vulnerable dependencies and other findings, but it is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare evidence; the assessment is performed by an independent assessor. Book a call.
Sources
Last reviewed: 18 October 2026.
