HITRUST CSF READINESS
Readiness delivery is 8 weeks for e1, 12 weeks for i1 and 16 weeks for r2. It is not a certification deadline.
Your healthcare partner has asked for HITRUST. We help you turn that request into a defined assessment scope, named control owners, an evidence plan and a prioritized roadmap to external validation.
We work with your team to choose the assessment your customer will accept, understand the gaps and organize the records your assessor will need. Your written proposal confirms the delivery schedule, fee and responsibilities before work begins.
01
02
03
Temi brings 20+ years of experience across technology, financial services, healthcare and media, with consulting engagements including Amazon, Walgreens and Humana. She has led over 100 assessments across her career and leads our HITRUST readiness work directly.
Connect with Temi on LinkedIn
04
A contract depends on it. A payer, health system or partner has specified HITRUST, and you need a realistic plan before committing to a date. We start with the exact requirement and the scope the partner expects.
You already hold other assurance. Your SOC 2 or ISO 27001 work gives you a starting point. We identify which records fit the HITRUST scope and what still needs to be built.
MyCSF work has stalled. Requirements are assigned unevenly, evidence is scattered or the next assessment step is unclear. We bring the ownership, gaps and submission dependencies into one plan.
05
HITRUST readiness prepares your organization for an assessment of its security controls. It connects the assurance your customer requests to the systems in scope, the people operating the controls and the records that show those controls are working.
The HITRUST CSF brings requirements from multiple security and privacy sources into a common framework. The selected assessment determines which requirements apply and how they are evaluated. Certification follows validation by a HITRUST Authorized External Assessor and HITRUST’s quality assurance process. We prepare your organization for that process; HITRUST makes the certification decision.
For healthcare companies and business associates, HITRUST can support a customer’s assurance request. It does not replace applicable HIPAA obligations or establish that every legal requirement has been satisfied.
Confirm the required assessment type before building the program. Company size alone does not settle the choice. Your partner’s requirement, system boundaries, risk profile and existing control maturity all matter.
The e1 assessment focuses on essential cybersecurity practices and may fit lower-risk or less complex environments where the requesting customer accepts it. Under CSF v11.9.0, its baseline contains 44 requirement statements. It scores implementation and leads to a one-year certification when the assurance requirements are met.
The i1 assessment uses a broader, threat-adaptive baseline for organizations with an established security program. CSF v11.9.0 contains 182 baseline requirement statements. It also scores implementation and has a one-year certification period. Confirm customer acceptance rather than assuming i1 satisfies a request for r2.
The r2 assessment selects requirements using the organization’s scope and risk factors. Its requirement count is tailored rather than a universal minimum. It evaluates policy, procedure and implementation; measured and managed maturity levels can also be included. Certification lasts two years, subject to the applicable interim requirements after the first year.
The assessment version matters. The counts above refer to HITRUST’s September 2026 v11.9.0 release. We check the version attached to your MyCSF assessment and any relevant transition requirements during scoping.
Healthcare technology and SaaS companies selling to payers or health systems; business associates handling protected health information; payments and services businesses with a healthcare partner’s HITRUST requirement; and teams that need to organize an assessment already underway.
Bring the requesting partner’s wording to the first conversation so the proposed work answers the actual requirement.
06
The work starts with the customer requirement and ends with a usable readiness package. Each phase has an owner and a review point. The plan separates work we will deliver from remediation your team must perform and the independent assessment that follows.
In a 30-minute readiness call with Temi, we review the partner’s requirement, deadline, systems and existing assurance work. We then confirm the assessment type, system boundary, scoping factors and MyCSF responsibilities. The scope records the assumptions needed to plan delivery.
We review the applicable requirements, policies, procedures and available implementation evidence. Control owners help explain how work happens in practice. The gap register distinguishes missing documentation, incomplete implementation and evidence that does not support the selected scope or period.
We organize evidence references and identify suitable reuse from existing compliance work. The corrective-action plan gives each gap an implementer, priority, dependency and proposed closure evidence. Policy and procedure guidance is provided to the depth agreed in the scope. Your team approves and carries out operational changes.
We walk through findings, unresolved risks, ownership and next steps. Your team receives the evidence index and preparation records needed for the assessor handoff. All three options include help answering assessor questions and evidence requests. The r2 option retains support through validation and HITRUST quality assurance.
The readiness delivery windows are 8 weeks for e1, 12 weeks for i1 and 16 weeks for r2. A readiness delivery date is separate from a certification date. The working sequence below preserves that distinction.
| Phase | Timing basis | Milestone |
|---|---|---|
| Scope and select | At kickoff; proposed first two weeks, subject to scope approval | Accepted assessment type, boundary and responsibilities |
| Assess and organize | During the agreed readiness window | Reviewed evidence, owners and gap register |
| Readout and handoff | By the agreed readiness delivery date | Readiness report, evidence index and roadmap |
| Remediate and build evidence | As control owners complete the work and applicable evidence periods | Changes implemented and records available for review |
| Validate and complete QA | After preparation; scheduled with the assessor and HITRUST | Independent validation and assurance decision |
Access to records, stakeholder availability, remediation effort and external assessment scheduling all affect progress. We raise dependencies early so leadership can make informed decisions about the customer deadline.
07
A readiness engagement should leave your team with records it can use, not a list of requirements to interpret alone. The agreed scope determines the depth of policy support, assessment preparation and assistance during validation. Each output records what was reviewed and what still needs attention.
The customer requirement, accepted assessment type, assessment version, entities, systems and dependencies. This gives leadership and the assessor a consistent account of what the engagement covers.
The scoping inputs, open questions, portal administrator, evidence-reference owner and approval points. Navigation support keeps the assessment organized while your organization retains responsibility for its information and approvals.
The applicable requirement, accountable owner, reviewed records, scoring basis and gap. The assessment type determines how maturity is considered. An assigned owner or uploaded file alone does not establish that a requirement is met.
Missing or inconsistent provisions, responsible approvers and operational procedures that need attention. Drafting guidance within the selected scope helps your team make the documents reflect how controls are actually performed.
Artifact locations, system boundaries, periods covered, custodians and review status. Sensitive records stay in the authorized repository; the status view can point to them without duplicating their contents.
A record of suitable SOC 2, ISO 27001, PCI DSS or HIPAA-related work, its relationship to the HITRUST requirement, and any missing evidence. Reliance on inherited controls is reviewed against the applicable HITRUST requirements and assessor expectations.
Each gap is paired with a priority, responsible implementer, dependency, target date and closure evidence. Technical configuration, security testing and ongoing control operation have an explicitly agreed delivery owner.
A findings walkthrough, leadership decisions, open items, owner briefings and the evidence references for handoff. Assessor questions and evidence requests are tracked across all three options so outstanding requests remain visible.
The shared worklist shows what is ready, waiting on evidence, overdue or blocked. At kickoff, we agree the review cadence, reporting format and escalation owner. Progress summaries identify changes since the last review and any effect on the planned delivery date. The worklist supports collaboration without requiring a new proprietary platform.
08
Choose the scope that matches the assessment you need and the support your team requires. We review the customer requirement, existing controls and remaining work before confirming the engagement.
| Criteria | Essentials e1 |
Comprehensive i1 |
Enterprise r2 |
|---|---|---|---|
| Starting price | From $9,000 per engagement | From $37,000 per engagement | From $60,000 per engagement |
| Delivery | 8 weeks | 12 weeks | 16 weeks |
| Scope | Assessment selection and scoping memo; MyCSF scoping; ownership map; implementation-focused gap register with relevant policy and procedure review; evidence structure and reuse map; roadmap and findings walkthrough. 30 days of follow-up access; 1 call. Assessor-question and evidence-request support. |
Core scoping, ownership, gap register, evidence and roadmap outputs; implementation scoring for the selected i1 baseline; policy and procedure gap drafting guidance; inherited-control review; corrective-action plan; external-assessor preparation and management readout. 30 days of follow-up access; 2 calls. Assessor-question and evidence-request support. |
Core readiness outputs with full scoping-factor analysis and tailored requirement selection; applicable maturity review, including measured and managed where targeted; evidence design across the selected scope; SOC 2, ISO 27001 and PCI DSS mapping; support through validated assessment and HITRUST quality assurance; leadership readout. 30 days of follow-up access; 4 calls. |
Delivery runs from kickoff and receipt of the required information and access, subject to the agreed scope. The written proposal confirms fee, deliverables, schedule, review points, payment milestones and responsibilities before work begins.
MyCSF subscription, HITRUST fees and External Assessor charges are separate from our readiness fee. We help identify those cost dependencies during planning. The proposal also distinguishes readiness from any separately agreed implementation or testing work.
The number of requirements helps describe an assessment, but the work needed to close each gap varies. Existing controls may reduce implementation effort when the scope, evidence quality and period fit. A certificate or policy title alone does not establish that reuse is possible.
Your engagement includes 30 days of follow-up access to clarify the report and next steps. Ongoing implementation, new assessments and continued security leadership are separately scoped. If you need help maintaining the program, discuss our vCISO service with Temi.
09
HITRUST, SOC 2, ISO 27001 and HIPAA address different needs. Starting with the assurance a customer accepts prevents your team from buying the wrong outcome. Shared controls can reduce duplicated work, while each assessment retains its own scope and reporting requirements.
A defined assessment route leads to HITRUST certification after external validation and central quality assurance. Your customer may specify e1, i1 or r2 and a particular scope. We confirm that requirement before organizing the readiness work.
An independent CPA examination produces a report on a service organization’s controls against the relevant Trust Services Criteria. Existing policies and operating records may support HITRUST preparation, but a SOC 2 report does not automatically satisfy a HITRUST requirement.
ISO 27001 addresses an information security management system. Certification is performed by an independent certification body; the customer’s accreditation expectations should be checked. Risk assessments, governance records and suitable control evidence may be reusable where they fit the HITRUST scope.
HIPAA is a legal regime for covered entities and business associates. HITRUST’s framework includes HIPAA mappings, but certification does not remove the organization’s responsibility to meet applicable HIPAA requirements. The assessment and the legal obligations must both be understood.
We compare the purpose, system boundary, period and supporting detail of each record before marking it reusable. The reuse map keeps the existing artifact, the applicable requirement and any remaining evidence need together. Your assessor determines what can be relied on for the validated assessment.
If several frameworks are on your roadmap, discuss a combined Governance Blueprint scope so the common work and framework-specific requirements can be planned together.
Direct access to Temi. The practitioner leading the readiness conversation stays involved in the assessment and readout, with experience across audit and program delivery.
Clear ownership. Findings identify who needs to act, the dependency to resolve and what evidence will support closure. Leadership can see the work behind the deadline.
A scope your team can review. The proposal records delivery assumptions, responsibilities and commercial terms before work starts. The final readout makes unresolved items visible.
An independent assessment handoff. We prepare your organization for the authorized assessor. An authorized External Assessor performs validation, and HITRUST makes the certification decision.
10
Start with the contract or security-review request. If it does not name an assessment type, confirm what the customer accepts before committing. The scoping discussion considers the data, systems, risk profile and assurance requirement.
e1 is foundational, i1 provides broader implementation assurance and r2 is tailored to risk and scope. Under CSF v11.9.0, the e1 and i1 baselines contain 44 and 182 requirement statements respectively. r2 has a tailored requirement set and considers additional maturity dimensions.
Readiness takes 8 weeks for e1, 12 weeks for i1 and 16 weeks for r2. Certification also depends on remediation, required operating evidence, assessor availability, validation and HITRUST quality assurance. We plan those dependencies separately and do not promise a certification date.
Readiness starts at $9,000 per engagement, subject to confirmation of your scope. The table sets out the available scope options. MyCSF, HITRUST and External Assessor fees are separate.
Yes, where its scope, period and evidence fit the selected assessment. Existing SOC 2, ISO 27001 or HIPAA-related work can reduce duplication. Every in-scope HITRUST requirement still needs to be addressed, and the reuse map shows what remains.
No. The framework maps to HIPAA requirements, but an organization must still meet its applicable legal obligations. HITRUST certification should not be described as an official HIPAA certificate or a guarantee of legal compliance.
No. An authorized External Assessor performs validation and HITRUST conducts quality assurance and makes the certification decision. We provide the readiness and support described in the agreed scope.
We work with your team to guide implementation, establish control ownership and organize evidence. If you don’t have an internal team, we provide hands-on governance support and coordinate the technical expertise needed to move your readiness program forward.
11
Discuss your assessment route and current tools before making that decision. MyCSF access and licensing are part of planning. We agree where evidence will live, who administers the assessment and how authorized reviewers will access the records.
The agreed worklist identifies owners, due dates, evidence status, blockers and decisions. The proposal or kickoff plan sets the reporting cadence. Findings remain open until the agreed evidence supports closure.
You receive 30 days of follow-up access for clarification about the readiness report and next steps. The pricing table shows the call allowance for each package. Continued implementation or security leadership can be scoped separately.
Your written proposal sets payment milestones and report review points before work begins. Any change to the agreed scope is discussed and documented.
Bring the customer’s exact requirement and deadline, a description of the systems and data involved, existing assessment or certification records, and the status of any MyCSF work. Tell us what is still missing so it can be included in scoping.
12
Start with the requirement that is holding up the decision. In a free 30-minute readiness call, Temi will discuss the assessment route, the work already completed and the gaps that need attention. You will have a clear next step for confirming scope and delivery.
Your written proposal confirms scope, fee, delivery assumptions and responsibilities before work begins.
Choose a time to discuss your HITRUST requirement with Temi.
If the calendar is unavailable, use the contact page to share your requirement and deadline.