First security hire asked to get HITRUST? Start with these questions

If you are the first security hire and someone says "we need HITRUST," do not start with controls. Start by learning who is asking, which of the three assessments they mean (e1, i1 or r2), and what systems are in scope. Those answers decide months of work, and they are usually vaguer than they sound.

Who is asking, and for what?

HITRUST is a customer-driven requirement. Find the actual source: a signed contract clause, a questionnaire line, or a sales rumour. Ask sales for the exact wording and the name of the buyer's security contact. Some buyers accept a different attestation, and many just want a credible program with evidence. You cannot decide the level until you know.

HITRUST lists three core assessments on one framework. The e1 has 43 foundational controls, the i1 has 182, and the r2 is the tailored, risk-based option used to demonstrate alignment with sources such as HIPAA. All three are built on the HITRUST CSF, and HITRUST says work can carry upward.

What should your first 30 days look like?

Resist the urge to buy tooling. Spend the first weeks mapping what exists.

1. Inventory systems and data: where regulated or sensitive data lives, who administers it, and which vendors touch it.
2. Collect existing policies and check whether anyone follows them.
3. Meet engineering, IT and HR leads. Controls live in their hands, and you need their calendars.
4. Write down what you inherit from your cloud provider and what remains yours.

By day 30 you want a one page picture: scope draft, candidate level, top gaps, and an owner per gap.

How do you choose a level as a newcomer?

Lean on the buyer requirement and your program maturity. The e1 targets startups and limited-risk environments. The i1 suits organizations whose security programs are already established. The r2 fits teams that must show compliance with authoritative sources or need controls tailored to their risk factors. A new program with one security person rarely belongs in r2 first. Because work carries upward, a smaller first step is defensible, but only if the customer will accept it.

What trips up first timers?

The biggest trap is evidence you cannot reproduce. A screenshot taken once for an auditor is weak. A report that regenerates every month is strong. Another is scope creep: adding systems because they feel important, which multiplies the work. A third is going alone. Name a sponsor with budget authority and an engineering counterpart who owns evidence requests.

Also be honest about gaps in writing. An assessor will find them, and a known gap with a dated plan reads better than a surprise.

What should you not promise?

Do not promise a certification date before the scope and level are fixed and engineering has agreed capacity. Do not tell customers you are HITRUST certified, or "aligned," until that is true and you can say exactly what the scope covers.

How to check or apply this

1. Get the written customer requirement.
2. Draft scope and an inventory of systems and vendors.
3. Pick the level with your sponsor, based on the requirement.
4. Rank gaps by effort and assign owners.
5. Set up recurring evidence for access reviews, patching and backups.
6. Agree a timeline with engineering before anything is shared outside.

Quick check

Sources

• HITRUST assessments and certifications

Last reviewed: 18 October 2026.