HITRUST e1 Essentials assessment
The entry-level HITRUST validated assessment and one-year certification built on a fixed set of foundational cybersecurity requirement statements, aimed at lower-risk organizations or as a first step toward i1 or r2.
HITRUST assessment types
The HITRUST assessments and add-ons an organization can pursue on the CSF: the e1, i1 and r2 certifications, AI security and AI risk management, the NIST CSF 2.0 add-on and Insights Reports.
HITRUST i1 Implemented assessment
The mid-level HITRUST validated assessment and one-year certification with a fixed, threat-adaptive set of 182 requirement statements that tests whether controls are implemented, without custom scoping of the control set.
HITRUST r2 Risk-based assessment
The most rigorous HITRUST validated assessment: a two-year certification with requirement statements tailored to the organization's risk factors, scored on policy, procedure and implementation maturity, with an interim assessment in year one.
HITRUST AI Security Assessment and Certification
HITRUST's certification for deployed AI systems, issued as ai1 when combined with an e1 or i1 and ai2 when combined with an r2, using AI-specific security requirement statements harmonized to NIST, ISO and OWASP.
HITRUST AI Risk Management Assessment
A non-certified HITRUST assessment of AI risk management practices, using 51 harmonized controls mapped to ISO/IEC 23894:2023 and the NIST AI RMF, that results in an AI Risk Management Insights Report.
HITRUST NIST CSF 2.0 add-on certification
An add-on to the HITRUST r2 that maps r2 results to NIST Cybersecurity Framework 2.0 and produces a HITRUST NIST CSF 2.0 certification report, without a separate assessment.
HITRUST Insights Reports
Add-on reports that map validated e1, i1 or r2 results to other frameworks such as HIPAA, NIST SP 800-171 and CMMC Level 1, so one HITRUST assessment can answer several compliance requests.
