Menu
Key facts
- Controls
- e1: 44 requirement statements in CSF v11.9 (43 in v11.7). i1: 182. r2: starts from the i1 requirements and adds requirements tailored to the organization's risk factors.
- Recertification cycle
- e1 and i1: 1 year. r2: 2-year certification.
- Ongoing oversight
- r2 requires an interim assessment in year 1 between certification audits
- Public registry
- HITRUST External Assessor directory ↗
- Common gap categories
- Access control (01.0); Risk management (03.0); Incident management (11.0); Privacy practices (13.0); Endpoint protection (08.0)
- Related standards
What is HITRUST?
The HITRUST Common Security Framework (HITRUST Alliance, current version v11.x, 2024) is a prescriptive, certifiable security framework that maps controls from HIPAA, NIST, ISO 27001, PCI DSS, GDPR, and others into a single unified model. It is primarily used in US healthcare and its supply chain.
Is HITRUST a certification or an attestation?
HITRUST issues a certification. A validated assessment report goes to HITRUST, which conducts quality assurance and issues the official certificate. The certification comes from HITRUST Alliance, not the external assessor firm.
Who needs HITRUST?
Required or strongly preferred by US health systems, payers, and pharma companies when onboarding technology vendors. Increasingly demanded in enterprise SaaS sales cycles as a proxy for HIPAA plus broader security assurance.
What does HITRUST cost and how long does it take?
e1: $20K–$70K. i1: $60K–$200K. r2: $150K–$1M for a large organization. Certification takes 3 to 18 months or longer, depending on the tier and the starting point. These are a HITRUST implementation firm's published estimates (November 2025); HITRUST publishes no price list.
The r2 band is wide because r2 scope is tailored to each organization. The source does not break the figures down, so ask each assessor whether a quote includes the MyCSF subscription, readiness work and the HITRUST quality review.