HITRUST is an assurance program with three core assessments built on one framework, the HITRUST CSF: e1 with 43 foundational controls, i1 with 182, and r2 for tailored, risk-based assurance. For a VP of engineering the real decisions are the scope boundary, the level to start at, and how much you can inherit from your cloud provider.
What are e1, i1 and r2?
HITRUST describes them as a traversable portfolio. The e1 is a one-year validated assessment on 43 foundational controls, aimed at startups and limited-risk environments. The i1 is a one-year validated assessment on leading security practices, for organizations with established programs. The r2 is a two-year validated assessment for organizations that must show compliance with authoritative sources such as HIPAA or the NIST Cybersecurity Framework, with controls tailored to risk factors.
Work from an e1 or i1 can be applied toward a larger assessment, so starting small is not a dead end.
Where does engineering carry the load?
Engineering owns the evidence for many control areas: access management, configuration, vulnerability management, logging, backup and software change. A readiness exercise usually surfaces the same gap pattern. Policies exist, but the system evidence is scattered across tickets, cloud consoles and chat.
HITRUST also says organizations can inherit existing controls from certified cloud service providers. That cuts the number of controls you must evidence yourself, but you still own configuration on your side of the shared line.
What should a VP decide first?
- Scope. Which systems and data flows are in the assessment boundary. Smaller is faster, but a scope that leaves out the system the customer cares about helps no one.
- Level. Choose the level your buyers will accept, not the one that sounds impressive. Ask the three customers pushing you for it which they require in writing.
- Timing. Decide whether the assessment competes with a launch. Evidence collection takes engineering hours every week.
- Ownership. Name one engineering owner for evidence, so requests do not scatter.
What does it not give you?
HITRUST's own materials make outcome claims about certified environments. Treat those as the vendor's claim and weigh them yourself. Certification shows controls were assessed at a point in time against a defined scope. It does not mean every system is secure, and a buyer will still read the scope statement.
How to check or apply this
- Collect written requirements from customers who asked for HITRUST.
- Draft a scope diagram of systems, data stores and third parties.
- Run a gap review of engineering evidence: access reviews, patch records, log retention, change approvals.
- List which controls a certified cloud provider can cover for you, and confirm what remains yours.
- Pick the level, then agree a calendar with engineering capacity booked.
What happens after the assessment?
Ask HITRUST or your assessor how long review and certification take after fieldwork, and build that into any date you promise a customer. The page we fetched gives terms of one year for e1 and i1 and two years for r2, and your scope statement travels with the result.
Between assessments, controls still have to operate. Teams that treat the first assessment as a sprint tend to struggle at renewal, because the evidence habits were never built into normal work.
A useful test of readiness: ask an engineer outside the compliance effort to find the last access review for production. If it takes more than a few minutes, the evidence is not yet a routine.
Quick check
Can e1 work count toward an r2?
HITRUST states that work from e1 or i1 can be applied toward a more comprehensive assessment, since all three share the same framework.
Does HITRUST replace HIPAA compliance?
No. The r2 can be used to demonstrate alignment with HIPAA among other sources, but legal obligations under HIPAA stay with you.
Sources
Last reviewed: 18 October 2026.
