A HITRUST checklist for engineers is a set of technical areas, each with a written standard, a working configuration and dated evidence: identity, encryption, logging, vulnerability management, change control, network, endpoints and recovery. How much you must show depends on whether you pursue the e1, i1 or r2 assessment.
Which HITRUST assessment are you preparing for?
HITRUST describes three assessments, all built on the HITRUST CSF. The e1 has 43 foundational controls, is valid for one year and suits startups and organisations with limited risk profiles. The i1 has 182 control requirements, is valid for one year and targets organisations with established security programs. The r2 has the highest number of control requirements, is valid for two years and focuses on regulatory needs such as HIPAA or NIST CSF, with controls tailored to risk. Work from an earlier assessment can count toward a later one, and you may inherit controls from certified cloud providers. Ask your HITRUST Authorized External Assessor for the current requirement statements, because the HITRUST page does not list them.
Because those statements are licensed material, the checklist below is organised by engineering theme. Map each line to the requirements in your assessment.
What should engineers have in place?
For each area, aim for three artefacts: the standard, the configuration and the proof.
Identity and access. Central identity provider, multi-factor authentication for staff and administrators, role-based access, unique accounts, prompt removal on departure, and periodic access reviews. Proof: a user and role export, enrolment report and a signed review.
Encryption. Protected data encrypted in transit and at rest, including backups and laptops, with managed keys. Proof: storage and endpoint configuration exports and a key rotation record.
Logging and monitoring. Logs of authentication, privileged actions and access to sensitive data, retained, protected from tampering and reviewed. Proof: log source list and a dated review.
Vulnerability and patch management. Inventory, scheduled scanning across code, dependencies, hosts and containers, severity based deadlines. Proof: scan output and closed tickets within deadline.
Secure development and change. Reviewed changes, protected branches, tested releases, separation of duties and rollback. Proof: branch settings and a sampled change from request to deployment.
Network and endpoint. Segmentation, firewall rules reviewed, managed endpoints with disk encryption, screen lock and malware protection. Proof: rule review record and fleet compliance report.
Recovery and continuity. Backups, a tested restore and an incident response plan exercised. Proof: restore test log and exercise notes.
Third parties. Inventory of service providers touching sensitive data, with agreements and reviews. Proof: register and the last review date.
What order saves time?
Do inventory and data mapping first, since HITRUST scoping starts with systems and data. Identity and logging next, because they feed many requirements. Then vulnerability management and change control, which generate evidence automatically once configured. Recovery testing goes last because it needs scheduling.
What mistakes cost the most?
- Scoping systems too narrowly and then discovering sensitive data flows outside them.
- Evidence without dates, so it cannot prove operation over the period.
- Policies written to match the framework and not the practice.
- Assuming a cloud provider's certification covers your configuration.
- Starting r2 work when e1 or i1 would meet the buyer's need.
How do you know the evidence is good enough?
Test it the way an assessor will. Pick a control, ask a colleague to find the proof without your help, and time them. If it takes more than a few minutes, or the proof lacks a date or system name, fix the filing and the export, not just the file. Do this for five random controls a month while you prepare, and you will find most weak spots before the assessor does.
What to do
- Confirm which assessment your customers will accept.
- Hire or choose an assessor and get the requirement statements.
- Build the scope, data flows and system inventory.
- For each theme above record the standard, configuration and proof.
- Run a restore test and an incident exercise.
- Do an internal sample review before the assessor starts.
Quick check
How many controls are in the HITRUST e1?
HITRUST describes the e1 as 43 foundational security controls, valid for one year.
Can e1 work count toward an i1 or r2?
Yes. HITRUST says the assessments share the CSF so earlier work can be built upon.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. For the vulnerability, dependency and change rows of this checklist, evidence is collected from connected systems and your real code through scans, SBOMs and reachability instead of screenshots, and monitoring continues between assessments. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose the categories that run automatically and the approval level. HITRUST validation is performed by an external assessor. Safeguard helps you prepare and keep evidence ready.
Open the framework mapping demo
Sources
- HITRUST assessments and certifications, fetched 18 October 2026
Last reviewed: 18 October 2026.
