What the HITRUST e1 Essentials assessment asks for and when it fits
If a customer or contract asks for HITRUST and you are deciding whether the e1 is enough, the short answer is that the e1 is the entry-level validated assessment with a fixed set of 44 requirement statements under CSF v11.9.0 and a one-year certification. It is built for organizations whose risk is lower and whose customers need independent proof of foundational cybersecurity rather than a tailored control review. Some HITRUST product pages still describe the e1 as 43 foundational controls. The 44 figure comes from the current v11.9.0 baseline, so confirm the count against the version your assessor will create the assessment on before you put a number in a contract or a questionnaire. The e1 has a practical advantage beyond its scope. Every e1 requirement sits in the i1 baseline, and every i1 requirement sits in the r2, so a passed e1 is a legitimate first step toward i1 or r2 rather than a separate exercise you later discard. Be aware that the e1 is still a validated assessment with a certification, not a self-declared questionnaire. Only an Authorized HITRUST External Assessor organization can perform the validated fieldwork submitted for certification, and HITRUST performs quality assurance before issuing the report. Plan for that independent step in your schedule and budget from the start. What usually makes the e1 hard is not the number of requirements but the state of the evidence. Teams often find that policies exist but are out of date, that access reviews or vulnerability scans were run once rather than on a repeatable cycle, or that controls operate for some systems and not others. Ask your assessor, before you commit, which evidence they will sample, how far back it must reach and who on your side owns each item. Confirm the current fieldwork window and creation deadlines in HITRUST's advisories, because a v11.8 assessment that is not created in time will be disabled on a set date.
Which systems, data and teams the HITRUST e1 covers
The e1 baseline is fixed, so scoping is less about choosing requirements and more about deciding where those requirements apply. Each decision below changes how much evidence the team must produce, who must produce it and which parts of the environment the assessor samples. Settle these before the assessment is created, because the scope you define becomes the scope the assessor tests.
In-scope systems and environments
Start by listing every system, application, network segment and environment that stores, processes or transmits the information the assessment covers, including production, disaster recovery and any staging copies that hold real data. Each one must have controls that apply to it and evidence that shows they operate. Ask whether test and development environments are in or out, and document the reason. A narrow boundary reduces sampling, but an assessor will still ask why a system that touches in-scope data sits outside the boundary.
Cloud and hosting inheritance
If workloads run on a cloud provider or managed hosting platform, determine which controls the provider covers and which remain with your team. Obtain the provider's own assessment reports and map their coverage to your scope. Your team still owns identity configuration, data handling choices and monitoring settings within the account. Confirm with the provider exactly what their report covers and for which services, because a general statement of compliance does not transfer control ownership to you.
Third parties that handle in-scope data
List each vendor, subprocessor and service provider that stores, processes or can access in-scope data, such as managed backup, support tooling or outsourced development. For each one, decide whether you rely on their independent report, require a contractual control commitment or treat the relationship as out of scope because they never touch the data. Keep the vendor register current, because the assessor will check whether the relationships you describe match the ones in your systems and contracts.
People who run and evidence controls
Name the owner of each control area, including the administrators who manage access, the engineers who apply patches and the staff who review logs and approve changes. The assessor tests whether these people actually perform the activity and can produce records of it. Define who collects evidence, who approves it and who answers assessor questions. A single person who holds every role often becomes the bottleneck during fieldwork, so decide early who is backup for each owner.
Fixed e1 baseline and control applicability
The e1 uses a fixed set of requirement statements, with no custom tailoring of the kind permitted in r2. Your decisions concern where each statement applies, not which statements you may drop. Mark a statement as not applicable only when the reason is documented and accurate for your environment. The v11.9.0 e1 baseline has 44 requirement statements, and each one must be addressed for the in-scope environment, so confirm the current count in MyCSF before you build the control inventory.
Decisions to record before creation
Before the assessment is created, write down the scope statement, the system inventory, the hosting and inheritance position, the vendor list, the named control owners and the rationale for every not-applicable decision. Assessment creation locks the CSF version, so the scope record should reflect the environment you expect to be tested during fieldwork. An independent assessor will review this record, and changes made late in the process often require rework of evidence already collected.
How an assessor tests the HITRUST e1 requirement statements
This table compares how an authorized assessor approaches each part of an e1 validated assessment, from test method to scoring and fieldwork. Read it as a preparation checklist: each row names what the assessor will look for and where organizations typically lose points.
| Aspect | What the assessor does | What the organization should prepare |
|---|---|---|
| Test approach | Examines each e1 requirement statement across the 19 assessment domains, using inquiry, observation and review of documents and system settings. | Assign a named owner per domain and confirm each statement maps to a live control, not only a written policy. |
| Evidence requested | Requests samples that show the control operated during the assessment period, such as access reviews, patch records and incident tickets. | Keep dated, exportable records from your own systems so the assessor can select samples without waiting on rebuilds. |
| Scoring rule | Scores each requirement statement, then checks that the core requirement statements in each domain average at least 83 to certify. | Identify core statements early and close the weakest ones first, since a low average in one domain can block certification. |
| Fieldwork window | Completes validated assessment fieldwork within at most 90 days, as set out in the HITRUST Assessment Handbook v1.1. | Plan evidence collection and interviews so the fieldwork period is not spent waiting for missing documents. |
| Quality assurance | HITRUST performs central quality assurance on the submission before it issues the report. | Expect follow-up questions on scoring and evidence after submission, and keep reviewers available to answer them. |
| Common findings | Flags statements where evidence covers only a point in time, where policy and practice differ, or where scope is unclear. | Confirm the system boundary and the evidence standard with the assessor before fieldwork begins. |
How to prepare for a HITRUST e1 assessment, step by step
This sequence moves an organization from confirming the CSF version and scope to a submitted e1 assessment. Each step ends with a named output, so the team can see what is finished before the assessor starts fieldwork.
Confirm the CSF version and create the assessment
The compliance lead checks in MyCSF which CSF version is the most current when the e1 is created. The e1 must be created on the most current version available at that point. From December 31, 2026, new e1 assessments must be created on v11.9.0, and e1 submissions on v11.8.0 or earlier are disabled from March 31, 2027. The step is done when the assessment record shows the correct version and the team holds the current list of 44 requirement statements.
Define the scope and system boundary
The CISO and system owners decide which systems, data stores, locations, people and third parties fall inside the assessment. They record the boundary and the reasons for each inclusion and exclusion. A scope statement signed by the accountable executive is the output. Any service provider whose controls are relied on should appear in it, so the assessor can see where responsibility sits.
Assign owners in a control-to-owner register
Each of the 44 statements receives one accountable owner, one or more supporting teams, and the systems where the control runs. The register also links each statement to the policy or procedure that describes it. Owners confirm their assignments in writing. The output is a control-to-owner register that the team can use as the working list for every later step.
Run a readiness review against the statements
Owners walk through each statement against the systems in scope and record whether the control is in place, partly in place, or not applicable. Any not-applicable decision needs a written rationale that the assessor can review. The team also checks whether the core statements in each domain are likely to average at least 83, since the handbook sets that threshold for certification. The output is a gap list with an owner and a priority for each open item.
Close gaps and build the evidence index
Owners fix the gaps on the gap list and gather the artifacts that show each control operating, such as configurations, tickets, logs, approvals and training records. The team stores them in a central location and indexes each file by statement, owner, system and date. Before fieldwork, confirm with the assessor the period of evidence it expects. The output is an evidence index that lets an assessor trace any statement to its proof.
Engage an authorized External Assessor
Only Authorized HITRUST External Assessor organizations can perform validated assessments submitted for certification. Check the HITRUST Find an External Assessor listing, then compare proposals against the written scope and independence rules. Ask whether the assessor will test the evidence index directly. The output is a signed engagement letter with a fixed scope, deliverables and timeline. DeployOpen prepares systems and evidence but does not act as the assessor.
Complete fieldwork and submit for certification
The assessor tests the evidence against each statement during a fieldwork window of at most 90 days. The team answers questions, supplies missing items and records any exceptions. The assessor then submits the assessment for HITRUST quality assurance. The step is done when HITRUST issues the certification report, which the assessor cannot issue on its own. The output is the issued e1 report and a renewal calendar for the next year.
Evidence that passes a HITRUST e1 review and how to keep it current
An e1 assessor tests a fixed set of requirement statements by sampling evidence from the assessment period, so the same few evidence families decide most outcomes. Each card below covers one family, what makes its artifacts acceptable, and how to keep them current between annual renewals. The organization must confirm the exact artifacts its assessor will accept in its own environment before fieldwork begins.
Current written policies and procedures
Assessors look for policies that are approved by a named owner, carry a version and effective date, and describe what staff actually do. A policy that predates the systems it governs fails at fieldwork because the assessor cannot trace it to a live control. Review each policy against the e1 requirement statements it supports, record the review date, and confirm the approval trail with your assessor before the assessment is created. Set a recurring review so nothing drifts between renewals.
Access review records
Evidence that accounts are granted, changed and removed according to need is among the most sampled artifacts. Keep dated access review exports that show who reviewed each account, what was decided, and how removals were carried out, including leavers and changed roles. Confirm with your assessor how far back samples can reach and whether screenshots, exports from your identity provider, or ticket records are acceptable. Repeat the review on a fixed schedule so the most recent cycle is always reproducible.
Configuration baselines and change records
A baseline shows the approved secure configuration for each system class, and a change record shows that a deviation was reviewed before it reached production. Assessors compare a sampled server or cloud resource against its baseline and then ask for the change ticket behind any difference. Store baselines in version control, tie each change to an approval, and export configuration state close to fieldwork. Ask your assessor whether automated configuration scans count as acceptable evidence for your platforms.
Vulnerability and patch records
Scan outputs, remediation tickets and patch deployment logs show whether weaknesses were found and closed in a reasonable time. Assessors typically sample a finding and follow it from detection to closure, so each item needs a timestamp, an owner, and a documented decision for anything accepted or deferred. Keep scanner scope aligned with the asset inventory, because a scan that misses systems in the sample will be questioned. Confirm your remediation timing expectations with the assessor in advance.
Incident and training records
Incident tickets, post-incident notes and security awareness completion records demonstrate that the organization responds to events and that staff are trained. Each incident record should show detection, triage, containment, and any lessons applied, and each training record should show who completed what and when. Assessors often sample a population of staff and check completion dates against onboarding and annual cycles. Maintain a current roster so the sampled population can be produced quickly at fieldwork.
Third-party assurance and inherited controls
When a cloud provider, hosting vendor or software supplier performs a control, the organization must hold evidence that the provider's controls exist and cover the relevant period, plus a shared responsibility record for the parts it still owns. Collect current assurance reports, note their coverage dates and any gaps against the e1 statements, and review them at least annually. Ask your assessor which vendor reports and inheritance records it will accept for your environment before relying on them.
What meeting the HITRUST e1 costs in money and effort
This table breaks the cost of an e1 certification into its components, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. Use it to frame a quote request, since HITRUST's published timing of a few weeks, about 30 days on average, and 4 to 6 weeks for well-prepared organizations is driven mostly by readiness rather than by the assessment itself.
| Cost component | One-time or recurring, and who is paid | What drives it up or down | What to request in a quote |
|---|---|---|---|
| Readiness and gap work | One-time. Paid to an internal team or a consultant to map existing controls to the e1 requirement statements. | Number of existing policies and documented controls, and how many gaps appear in the first review. Strong existing evidence shortens the work. | A written gap list, the named people doing the work, and the hours each person is expected to spend. |
| Engineering time for controls and logging | One-time build, with recurring upkeep. Paid as internal staff time or to an implementation partner for configuration. | Number of systems in scope, whether access control, logging and backups are already centralized, and how many third parties handle data. | Which systems are in scope, what is configured versus confirmed, and what evidence each change will produce. |
| HITRUST tooling and MyCSF access | Recurring while the assessment is active. Paid to HITRUST for platform access; confirm current subscription terms with HITRUST. | Number of users who need MyCSF access and whether an external consultant or internal team manages the workspace. | Current MyCSF pricing for your account, which users are licensed, and what the fee includes. |
| Open-source and licensing spend | Recurring for commercial tools, one-time for setup. Paid to software vendors or to a support provider. | Choice between commercial and self-hosted tools, and whether support contracts are needed. Self-hosted tools can lower license spend. | Each license or support fee, its renewal date, and whether a self-hosted option covers the same evidence need. |
| External assessor fees | One-time per validated assessment. Paid to an Authorized HITRUST External Assessor organization, which must perform the validated assessment. | Assessor's fieldwork window (at most 90 days), the number of systems sampled, and how ready the evidence is when fieldwork starts. | A fixed quote tied to the scope, the sampling approach, what is excluded, and whether HITRUST quality assurance review is included. |
| Internal staff time during fieldwork | One-time per assessment. Paid as internal salary cost; no external invoice. | Speed of evidence requests, the number of control owners who must answer, and whether a single coordinator handles questions. | A named coordinator, a response-time expectation from the assessor, and the control owners who must be available. |
| Annual renewal effort | Recurring every year, since an e1 certification is valid for one year and must be renewed annually. | Whether controls and evidence were kept current during the year, and whether the CSF version changes at renewal. Note that new e1 assessments must use CSF v11.9.0 from December 31, 2026. | A renewal plan, the assessor's renewal scope, and an estimate of staff hours for the next cycle, confirmed in writing. |
Who does what in a HITRUST e1 engagement
Your organization owns the e1 scope, the controls and the decisions behind them. Nobody else can accept residual risk on your behalf, sign off on policies or confirm that a control operates as described day to day. Internal staff also answer the assessor's questions during fieldwork, so they need to know the environment well enough to explain it without relying on a consultant in the room.
- Scope and ownership: Name an accountable owner for the e1, usually in security or compliance, and confirm which systems, locations and people fall inside the assessment boundary.
- Policies and decisions: Approve the written policies, risk decisions and any N/A or alternate control choices that appear in the assessment.
- Operating evidence: Produce access reviews, change records, vulnerability reports and training logs as they happen, not only when the assessment begins.
- Assessor access: Provide the assessor with systems, people and documents within the fieldwork window, which is at most 90 days for e1.
- Ongoing duties: Keep the certification valid by renewing it annually and reporting significant changes to the environment.
Before you start, confirm in writing who inside your organization will answer for each domain of the e1.
An implementation partner such as DeployOpen prepares systems and evidence so your team and the assessor can work from a clean starting point. This work is commonly outsourced because it is specialized and time-consuming. The partner does not decide what the e1 concludes, and its staff do not sign the assessment or the resulting report.
- Readiness review: Compare current controls against the e1 requirement statements and list gaps with owners and a remediation order.
- Control implementation: Configure, harden and document the controls in your self-hosted platforms, inside your own cloud accounts, data centers or air-gapped networks.
- Evidence preparation: Set up logging, collection and retention so that evidence is produced in a form an assessor can sample and trace.
- Documentation: Draft procedures and system descriptions for your review, with the final approval remaining with your organization.
- Independence limit: The partner should not perform the validated assessment, select the assessor's samples, or write findings that the assessor would be expected to make.
Ask the partner to state in its written scope which deliverables it owns and which decisions stay with you.
Only an Authorized HITRUST External Assessor organization may perform the validated assessment submitted for certification. The assessor tests the controls independently, reaches its own conclusions and submits the results. HITRUST then performs central quality assurance before any report is issued, so the certification depends on both the assessor's work and HITRUST's review.
- Independent testing: The assessor selects samples, inspects evidence and interviews staff without being guided toward favorable answers.
- Fieldwork window: Validated assessment fieldwork for e1 runs for at most 90 days, so plan evidence collection to fit that period.
- Submission and review: The assessor submits the assessment, and HITRUST quality assurance reviews it before a report is issued.
- Selection: Confirm the assessor appears on HITRUST's current list of Authorized External Assessors before you sign anything.
- Separation from preparation: An assessor that prepared your controls or evidence may face independence limits, so ask how it will handle that conflict before engagement.
Verify the assessor's authorization status on HITRUST's Find an External Assessor page and get its independence position in writing.
What changes for an e1 under CSF v11.9.0 and the version deadlines
The version you assess against is now set by the date you create the assessment. HITRUST CSF v11.9.0 was released on September 24, 2026, and it changed the baselines for both the e1 and the i1. Under that version, the e1 baseline has 44 requirement statements, and every one of them also appears in the i1 baseline, so an e1 built on v11.9.0 lines up cleanly with a later move to i1. HITRUST's product pages still describe the e1 as 43 foundational controls, so do not copy that count into a project plan or a customer questionnaire without checking the current baseline in MyCSF. For an organization planning an e1 now, the practical question is which version your assessment will be created on, because that determines which requirement statements your team must evidence.
From December 31, 2026, new e1 and i1 assessments must be created on v11.9.0, including rapid assessments. Submissions built on v11.8.0 or earlier are disabled from March 31, 2027. The gap between those two dates is the window where a planning error is most likely: a team that starts an e1 in early 2027 on an older version may find its work cannot be submitted as planned. If your timeline runs past December 31, 2026, decide now whether to create the assessment on v11.9.0 and rebuild your evidence against the updated statements, rather than assuming the earlier baseline will remain available. Ask your External Assessor which version they will work on and when the assessment object must be created in MyCSF.
Confirm the dates and your eligibility before you commit a budget or a customer deadline. Check the effective dates and the rules for rapid assessments in the HITRUST advisories, and confirm in MyCSF which CSF version your organization can select on the day you create the assessment. If you already hold an e1 and may be eligible for a rapid assessment in year two, verify that eligibility with HITRUST directly, since it depends on your certification status and version history. Record the confirmed dates, the version number and the name of the person who verified them, then reconfirm the plan if HITRUST issues a further advisory before your creation date. Treat any date you have not checked against those sources as unconfirmed.
HITRUST e1 questions buyers ask before hiring help
How much effort and cost should we expect for a HITRUST e1?
The cost comes from three places: internal staff time to gather evidence, any readiness help you buy, and the fee of an Authorized HITRUST External Assessor that performs the validated assessment. HITRUST says most organizations average about 30 days for e1 certification, and it cites as few as 4 to 6 weeks depending on readiness, so your starting point drives the total. The assessor fee is a one-time cost per assessment, while the annual renewal recurs. Ask each vendor for a written scope that lists the requirement statements, the systems in scope, the evidence to be prepared, the MyCSF subscription, and whether readiness work and the assessor fee are priced separately.
How long does the HITRUST e1 assessment take from start to finish?
Plan around the readiness work first, because the validated fieldwork is short by comparison. HITRUST says e1 certification can take a few weeks, with most organizations averaging about 30 days, and elsewhere cites as few as 4 to 6 weeks depending on readiness. The assessor's validated fieldwork window is at most 90 days for e1, i1 and r2. Your timeline also depends on the CSF version in use: under CSF v11.9.0, released September 24, 2026, the e1 baseline has 44 requirement statements, and new e1 assessments must be created on v11.9.0 from December 31, 2026. Confirm the version and target dates with your assessor before you commit to a schedule.
What does the e1 need from our internal team?
The e1 needs a named owner who can answer for the requirement statements, plus engineers and administrators who can show how controls work in practice. Expect the work to fall into three groups:
- Policy and ownership: current written policies, asset inventory, and clear roles for access, incident response and vendor management.
- Technical evidence: configuration exports, access reviews, patch records, backup and logging evidence for the systems in scope.
- Assessment support: someone to schedule walkthroughs, answer assessor questions and track gaps.
If these people are unavailable for the length of fieldwork, the timeline slips regardless of who performs the assessment.
Can we run a HITRUST e1 without an outside partner?
Yes, an organization can prepare its own controls and evidence, but it still needs an Authorized HITRUST External Assessor to perform the validated assessment that can be submitted for certification. Internal teams with strong security operations and some familiarity with HITRUST's requirement language often handle the e1 themselves. A partner is more useful when the team lacks time, has never mapped controls to a HITRUST structure, or needs help closing technical gaps before fieldwork. DeployOpen prepares systems, controls and evidence for assessments under a fixed-scope written agreement, and it does not perform the validated assessment. Confirm with any partner which tasks they will do and which remain yours.
Why can't our implementation partner issue the HITRUST e1 certification?
Certification depends on independence. Only Authorized HITRUST External Assessor organizations may perform the validated assessments submitted for certification, and HITRUST performs central quality assurance before issuing reports. A partner that built or prepared your controls cannot also be the party that tests them and attests to the result. In practice, the partner prepares systems, configurations and evidence, and the independent assessor tests them. Be cautious of any vendor that promises a certificate as part of an implementation fee, and ask which Authorized HITRUST External Assessor will perform the assessment.
How does the e1 compare with i1 and r2 when choosing a level?
The three assessments form a traversable portfolio: every e1 requirement is in the i1 baseline, and every i1 requirement is in the r2 baseline. Under v11.9.0, the e1 has 44 requirement statements and the i1 has 182. The e1 suits lower-risk organizations or a first step toward i1 or r2. The i1 uses a fixed, threat-adaptive set of requirements and runs on a one-year cycle. The r2 is tailored to your risk factors, carries a two-year certification, and requires an interim assessment within the 90 days before the first anniversary. Choose based on what your customers and contracts require, and confirm the level in writing before starting.
What happens when our HITRUST e1 certification comes up for renewal?
An e1 certification is valid for one year and must be renewed annually. Renewal means a new validated assessment against the CSF version current at creation, so controls and evidence should be kept current throughout the year rather than rebuilt in a rush. An organization holding an e1 may be eligible for an e1 rapid assessment in year two, which HITRUST describes in its Assessment Handbook. Ask your assessor or partner to confirm eligibility, the CSF version to be used, and what evidence will be refreshed. Budget for the renewal fee and any readiness work as recurring costs.
How DeployOpen prepares a HITRUST e1 environment and its evidence
DeployOpen prepares the self-hosted open-source systems and the evidence behind them so your organization can take a HITRUST e1 validated assessment to an Authorized HITRUST External Assessor. DeployOpen does not perform the assessment or issue the certification; your organization owns its controls and the independent assessor makes the determination.
How we scope
- The written scope lists which e1 requirement statements touch the self-hosted platforms inside your environment.
- Scope names the cloud accounts, data centers or air-gapped networks where the in-scope systems run.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work starts.
How we build
- Systems are configured and hardened so that access, logging and change records can be produced on request.
- Each in-scope requirement statement is paired with the configuration, log or record an assessor would sample.
- Testing confirms controls operate as documented before the environment is presented as ready for fieldwork.
How we hand over
- Documentation covers system design, control ownership and the evidence location for each requirement statement.
- Evidence is organized so your team can answer assessor sample requests without rebuilding it from memory.
- Your staff receive operating runbooks, and the handover is recorded against the agreed written scope.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers for the annual e1 renewal cycle.
- Changes to platforms or the CSF version are reviewed for their effect on evidence before the next assessment.
- Confirm with your assessor which evidence formats and sampling rules they accept before the scope is signed.
