HealthcareUSA

HITRUST

Coordinate the work behind HITRUST readiness

Keep control owners, assessment preparation and supporting evidence aligned with your agreed HITRUST scope.

Full name
HITRUST CSF, the framework behind the HITRUST assessment and certification programme
Issued by
HITRUST, a US organisation that maintains the framework and runs its assurance programme
Current version
CSF v11.9.0, released 24 September 2026. HITRUST updates the CSF several times a year.
Nature
Voluntary, licensed framework with certifiable assessments, validated by an authorised external assessor and quality-reviewed by HITRUST
Assessments
e1 (1 year), i1 (1 year) and r2 (2 years with an interim assessment), plus an optional AI Security add-on
Structure
14 control categories, broken into control objectives, control specifications and requirement statements

Overview

What HITRUST CSF is

The HITRUST CSF is a security and privacy framework that harmonises requirements from many authoritative sources, such as ISO/IEC 27001, NIST SP 800-53, the HIPAA Security Rule and PCI DSS, into one set of controls. The aim is to assess once and report many times: a single HITRUST assessment can give assurance against several standards and regulations at once. It began in healthcare and is now used more widely, particularly by service providers whose customers ask for HITRUST certification in vendor due diligence.

HITRUST offers three main validated assessments. The e1 is an essentials assessment of foundational cybersecurity. The i1 is a broader implemented, one-year assessment built around a threat-informed baseline of good security practice. The r2 is risk-based and tailored to the organisation’s risk profile, technology and scope, gives the most assurance, and is certified for two years with an interim assessment at the one-year mark. In CSF v11.9.0, the e1 baseline has 44 requirement statements and the i1 baseline has 182.

Every validated assessment is tested by a HITRUST Authorised External Assessor firm and then reviewed by HITRUST’s own quality assurance before HITRUST issues the report and, where the result passes, a certification. Assessments are scoped and managed in MyCSF, HITRUST’s platform, which also supports inheritance of controls already assessed at cloud and service providers.

HITRUST updates the CSF regularly, reconciling it against threat intelligence and adding or refreshing authoritative source mappings. Version 11.9.0 refreshed the NIST SP 800-53 mapping, modified the HIPAA mappings and added an Agentic AI factor for the AI Security Certification. HITRUST publishes transition deadlines by advisory when assessments must move to a newer version. The full framework is available from HITRUST under its licence terms.

Who it applies to

HITRUST certification is voluntary. It is most often sought by:

  • Health systems, payers and other healthcare organisations
  • Business associates and vendors that handle health information for US healthcare clients
  • SaaS, cloud and managed service providers asked for HITRUST in customer due diligence
  • Organisations that want one assessment mapped to several frameworks and regulations
  • Providers of AI systems, through the optional AI Security assessment
  • Indian IT services, BPO and health technology firms serving the US healthcare market

HITRUST does not replace legal obligations such as the HIPAA Security Rule. It is a way of showing that controls are in place and assessed.

Structure

How the CSF is organised

HITRUST publishes the CSF in 14 control categories, numbered 0 to 13. The v11.7.0 introduction lists 49 control objectives and 156 control specifications beneath them. Requirement statements are selected for each assessment by assessment type and by organisational, system and compliance factors.

Governance

Programme, policy, risk and organisation

0 Information Security Management Program
Establishing and running an information security management programme.
3 Risk Management
Risk management programme, assessment and mitigation.
4 Security Policy
Information security policy documents and their review.
5 Organization of Information Security
Internal organisation, roles and responsibilities, and external parties.
6 Compliance
Compliance with legal requirements, security policies and technical standards, and audit considerations.
People and assets

People, assets and facilities

2 Human Resources Security
Security before, during and after employment, including awareness and training.
7 Asset Management
Responsibility for assets and classification of information.
8 Physical and Environmental Security
Secure areas and equipment security.
Technical

Access, operations and development

1 Access Control
User access management, user responsibilities, and network, operating system, application and mobile access control.
9 Communications and Operations Management
Operational procedures, third-party service delivery, malicious code protection, backup, network security, media handling, exchange of information and monitoring.
10 Information Systems Acquisition, Development and Maintenance
Security requirements, correct processing, cryptographic controls, system files, development and support processes, and technical vulnerability management.
Resilience and privacy

Incidents, continuity and privacy

11 Information Security Incident Management
Reporting security events and weaknesses, and managing incidents and improvements.
12 Business Continuity Management
Information security aspects of business continuity management.
13 Privacy Practices
Privacy requirements, included in an assessment when privacy is in scope.
Assessments

The assessment portfolio

e1 (Essentials, 1-year)
Foundational cybersecurity hygiene. 44 requirement statements in v11.9.0.
i1 (Implemented, 1-year)
A fixed, threat-informed baseline of good security practice. 182 requirement statements in v11.9.0, including all e1 requirements.
r2 (Risk-based, 2-year)
Tailored to the organisation’s risk factors and scope, with the highest number of requirements and maturity scoring. An interim assessment is required at one year.
AI Security add-on
Up to 44 AI-specific requirements, depending on tailoring. ai1 pairs with e1 or i1 and ai2 with r2, valid for the same period as the underlying certification.
Method

Tailoring, scoring and inheritance

Risk factors and tailoring
Organisational, system and compliance factors decide which requirement statements apply in an r2, so the assessment fits the organisation’s size, data, technology and regulatory obligations.
Maturity scoring
HITRUST’s rubric scores requirements across policy, procedure, implemented, measured and managed, based on how fully each is met.
Inheritance
Through the Shared Responsibility and Inheritance Program, organisations can inherit results for controls already assessed at participating cloud and service providers, or from their own earlier assessments, instead of testing them again.
MyCSF
HITRUST’s platform for scoping assessments, recording evidence and scores, managing corrective action plans and working with the external assessor.

Implementation roadmap

How to implement it, step by step

A typical route to a first HITRUST certification.

  1. 1

    Choose the assessment

    Decide between e1, i1 and r2 based on customer expectations and risk. Consider whether the AI Security add-on applies. Some organisations start with e1 or i1 and move to r2 later.

    OutputsAssessment choiceBusiness case
  2. 2

    Define the scope

    Set the systems, locations and services in scope, and for r2 answer the risk factor questions that tailor the requirement statements.

    OutputsScope statementTailored requirements
  3. 3

    Engage an External Assessor

    Select a HITRUST Authorised External Assessor firm and agree the timeline.

    OutputsEngagement letterAssessment plan
  4. 4

    Run a readiness assessment

    Score yourself against the requirements, identify gaps and find controls that can be inherited from cloud or service providers.

    OutputsReadiness resultsInheritance requests
  5. 5

    Remediate and evidence

    Close gaps, approve policies and procedures, and make sure each control produces evidence as it operates.

    OutputsRemediation planEvidence library
  6. 6

    Validated assessment and QA

    The External Assessor tests the requirements and submits the assessment. HITRUST reviews it through quality assurance before issuing the report.

    OutputsValidated assessmentQA responses
  7. 7

    Certification and corrective actions

    HITRUST issues the report and, where the result passes, a letter of certification. Track any corrective action plans to closure.

    OutputsHITRUST reportCorrective action plans
  8. 8

    Maintain and renew

    Renew e1 and i1 each year. For r2, complete the interim assessment at one year and a full reassessment before the two-year expiry.

    OutputsInterim assessmentRenewal plan

Audit and evidence guide

What auditors look for, and the evidence to keep

HITRUST assessments are validated by an authorised external assessor and quality-reviewed by HITRUST before any certification is issued. The assessor looks for evidence that each requirement is met to the level the assessment type requires.

The assessment cycle

  1. Step 1

    Scoping in MyCSF

    The organisation sets up the assessment object, scope and, for r2, the risk factors that select requirement statements.

  2. Step 2

    External Assessor testing

    The HITRUST Authorised External Assessor firm tests each requirement through inquiry, inspection and observation, and records scores in MyCSF.

  3. Step 3

    HITRUST quality assurance

    HITRUST reviews the submitted assessment and may raise questions to the assessor and the organisation before finalising.

  4. Step 4

    Report and certification

    HITRUST issues the assessment report and, where the result passes, a letter of certification valid for one year (e1, i1) or two years (r2).

  5. Step 5

    Interim and renewal

    An r2 needs an interim assessment at the one-year mark. All assessments are renewed before they expire.

What reviewers look for

  • A scope that matches the systems and services customers rely on
  • Risk factor answers that reflect the real environment for r2
  • Written policies and procedures for each requirement, where scored
  • Evidence that controls are implemented across the whole scope
  • Measurement and management of controls, where maturity is scored
  • Inherited controls supported by the provider’s own HITRUST results
  • Access management, logging and monitoring across in-scope systems
  • Vulnerability management, incident response and business continuity
  • Third-party assurance for service providers in scope
  • Corrective action plans for gaps, tracked to closure

Key timelines

e1 certification1 year
i1 certification1 year
r2 certification2 years
r2 interim assessmentAt the 1-year mark
AI Security certificationSame as paired assessment
CSF version updatesSeveral times a year

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Governance

  • Information security programme
  • Approved policies and procedures
  • Risk assessment

Scope

  • Scope statement and system list
  • Risk factor answers
  • Inheritance records

Access

  • Access requests and approvals
  • Access reviews
  • MFA configuration

Operations

  • Logging and monitoring records
  • Vulnerability scans and patching
  • Change records

Resilience

  • Incident records
  • Business continuity and DR tests
  • Backup and restore records

People and vendors

  • Awareness training
  • HR onboarding and offboarding
  • Vendor assessments

Maturity

  • Control metrics
  • Management reviews of metrics
  • Corrective action plans

Areas that often need attention

  • Policies that exist but procedures that do not
  • Controls implemented on some in-scope systems but not all
  • No measurement of controls where measured and managed levels are scored
  • Inheritance claimed without the provider’s supporting results
  • Scope or risk factor answers that understate the environment
  • Evidence gathered late, delaying assessor testing and QA
  • Corrective action plans left open after certification
  • Missing the r2 interim assessment date

How Netra helps

Where each part of the work lives in Netra

Netra organises the work behind a HITRUST assessment: owners, tasks, policies and evidence. The assessment itself runs in MyCSF with your External Assessor.

Requirements owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks keep operating evidence current between assessments.

Readiness across frameworks

Compliance Centre

Status is derived from completed tasks and evidence, never typed in. Work done for ISO 27001, SOC 2 or HIPAA also counts where the same control applies.

Policies and procedures

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Risk assessment

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as the linked tasks are completed.

Scope and systems

Asset Management

Assets linked to tasks, so teams know which in-scope systems each requirement covers.

Readiness reviews and corrective actions

Audit Centre

Run internal readiness audits end to end, with findings and corrective actions, and evidence in a tamper-evident vault.

Vendors in scope

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Netra supports readiness and evidence. It does not replace MyCSF, HITRUST’s assessment process or your External Assessor, and it does not grant HITRUST certification. HITRUST CSF content is licensed by HITRUST.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Healthcare

HIPAA Security

Keep ePHI safeguards connected to accountable work

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

Security

NIST SP 800-53

Organise a tailored security and privacy control programme

See HITRUST in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.