Two-minute brief
HITRUST CSF requirements explained: video brief
A two-minute brief on how HITRUST CSF decides which requirements apply and how its validated assessments lead to certification.
Key takeaways
- No organisation implements the whole HITRUST CSF library.
- The e1 has 43 controls, the i1 182, and the r2 a tailored set.
- Requirement statements are tailored in MyCSF.
- External Assessors test; HITRUST quality-assures and certifies.
- One assessment can support many customer requests.
A library of controls, selected by assessment
The HITRUST CSF is a library of control requirements drawn from its authoritative sources, and no organisation implements the whole library. The assessment chosen decides which requirements apply: 43 foundational controls in the e1, 182 leading-practice controls in the i1, and in the r2 a set tailored to the organisation's risk profile, technology environment, business operations and assessment scope. The requirement statements are tailored for each assessment in MyCSF, HITRUST's platform. This short film shows how the scheme fits together.
Scope is defined first: the organisation, systems, platforms, facilities and data the assessment covers. In practice that means a scope statement a customer can read and an inventory of systems and data flows. For the r2, the scoping answers about risk factors also shape which requirements apply.
Validated assessment and certification
Each control is tested by an External Assessor firm that HITRUST has approved, vetted and trained. The assessor's work is reviewed through HITRUST's central quality assurance and, where the result qualifies, HITRUST issues the certification. The e1 suits start-ups and lower-risk environments, the i1 a broader leading-practice baseline, and the r2 the most demanding environments. The e1 and i1 certifications are valid for one year; the r2 is valid for two years with an interim assessment.
The framework harmonises more than 70 authoritative sources, including ISO/IEC 27001, NIST SP 800-53, HIPAA, PCI DSS and GDPR, so one assessment can support several customer requests. The current release is HITRUST CSF v11.9.0. It is relevant to health-tech, SaaS, BPO, billing and data-services firms whose customers ask for HITRUST, and to healthcare organisations themselves.
The assessment is chosen by what customers will accept and the depth the risk justifies: the e1 suits start-ups and limited risk profiles, the i1 a programme with leading security practices, and the r2 the highest assurance. A HITRUST certification is not HIPAA compliance: it shows that an External Assessor tested controls against the HITRUST CSF and that HITRUST quality-assured and certified the result. Controls a cloud provider operates can be inherited where it holds validated HITRUST results, while the organisation's own side of each shared control is still tested.
HITRUST CSF at a glance
- Purpose
- Independent, centrally quality-assured evidence that sensitive and health information is protected against one harmonised control framework, shareable with many customers
- Relevant to
- Health-tech, SaaS, BPO, billing and data-services firms whose customers ask for HITRUST, and healthcare organisations themselves; the e1 suits start-ups, the r2 the most demanding environments
- Edition
- HITRUST CSF v11.9.0, the current release on HITRUST's framework page (checked September 2026); assessed through the e1 (43 controls), the i1 (182 controls) or the tailored r2
- Certification
- A HITRUST-authorised External Assessor performs the validated assessment; HITRUST quality-assures it and issues the certification: e1 and i1 valid one year, r2 two years with an interim assessment
- Sterling's role
- Assessment choice, scoping, gap analysis, implementation with your team, Effivity, training and validated-assessment readiness, then Sustain™
- Cost and timing
- Total investment for a HITRUST programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 12 months
HITRUST CSF: questions people ask
Which HITRUST assessment do we need: e1, i1 or r2?
The one your customers will accept, at the depth your risk justifies. HITRUST positions the e1, with 43 foundational controls, for start-ups and organisations with limited risk profiles; the i1, with 182 controls, for organisations whose security programme is already robust; and the r2, a tailored requirement set, for those that must demonstrate compliance with sources such as HIPAA or the NIST Cybersecurity Framework. Ask the customer to put its requirement in writing before you commit.
Is HITRUST certification the same as HIPAA compliance?
No. A HITRUST certification shows that an External Assessor tested your controls against the HITRUST CSF and that HITRUST quality-assured and certified the result. The CSF maps HIPAA, and HITRUST offers Insights Reports that map results to it, but the US Department of Health and Human Services states that it does not endorse or recognise private organisations' certifications regarding the Security Rule. Business associate agreements, breach notification and the rest of your HIPAA obligations remain yours either way.
Does Sterling perform the assessment or issue the certification?
No. Sterling prepares your organisation. The validated assessment is performed by an External Assessor firm that HITRUST has vetted and approved, and HITRUST reviews that work through its quality assurance and issues the certification. Keeping preparation and assessment in separate hands is what makes the result credible to your customers.
How long is a HITRUST certification valid?
An e1 or an i1 certification is valid for one year. The i1 can be renewed through a rapid recertification in its second year, which concentrates on around 60 core controls. An r2 certification is valid for two years and requires an interim assessment after the first year to confirm continued compliance.
How long does it take to get HITRUST certified?
Mostly it depends on the assessment and your starting point. HITRUST states that most companies complete the i1 certification process within six to twelve months, and that an e1 can deliver assurance in as few as four to six weeks. Expect longer when controls still have to be built, and longest for a first r2. Our plan is built on your scope, your gaps and your customer's date, not on a headline figure.
Keep exploring
Related to this video
The complete guide
Everything on HITRUST CSF
Start with the HITRUST CSF page, or go straight to the guide you need.
On the HITRUST CSF page
Often combined with HITRUST CSF
More videos: Healthcare, medical devices and life sciences
- How to implement ISO 14971Implementation walkthrough · 3 min 15 s
- ISO 14971 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 13485Implementation walkthrough · 3 min 24 s
- ISO 13485 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22716Implementation walkthrough · 3 min 24 s
- ISO 22716 requirements explainedTwo-minute brief · 2 min
- ISO 7101 requirements explainedTwo-minute brief · 2 min
- How to comply with ADHICS in Abu DhabiCompliance walkthrough · 3 min 15 s
- ADHICS requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your HITRUST certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice