What HITRUST Insights Reports answer for buyers and auditors
When a customer, regulator or contract asks for a framework other than HITRUST, the practical question is whether a HITRUST validated assessment can answer it without a second engagement. An HITRUST Insights Report is the add-on that answers that question. It takes a validated e1, i1 or r2 result and restates it in another framework's terms. HITRUST offers ten: HIPAA, PHIPA, NIST SP 800-171, CMMC Level 1, Ransomware, NY OHIP, GovRAMP, HICP, HPH CPG and AI Risk Management. Treat the Insights Report as a separate deliverable from the certification itself. The certification says the HITRUST assessment passed. The Insights Report shows how those results line up with the other framework's requirements, and it does not create a new certification in that framework.
The reason these reports are hard to get right is that the mapping only means something if the underlying assessment is complete and scoped correctly. An Insights Report cannot cover a control the validated assessment never tested, and it cannot fix a scope that left out the systems the other framework cares about. For e1 and i1, the report requires a combined assessment with the relevant compliance factor selected, so the choice of factor is a scoping decision that should be made before fieldwork starts, not after results come back. Ask your assessor which factor and which systems the chosen report depends on, and confirm in writing which requirement statements feed it.
Before you commit, check three things with your external assessor and with the framework owner or your customer. First, confirm the exact Insights Report edition and version the requester accepts, since the CSF version in force affects the mapping. Second, read the HITRUST Insights Reports page for the current requirements of the report you need. Third, confirm with the requester whether they accept an Insights Report in place of their own questionnaire or audit, because that acceptance is their decision, not HITRUST's or the assessor's. Plan the assessment scope around those answers so the report does not expose a gap you discover only when the customer asks.
Which of the ten Insights Reports fits which request
Each Insights Report repackages a validated e1, i1 or r2 result in another framework's terms, so the request in front of you usually decides which report to pursue. The cards group the ten reports by the kind of customer, regulator or contract that triggers them. Confirm the current scope of each report with HITRUST before you commit, because HITRUST sets the report contents.
Healthcare privacy and security requests
The HIPAA report answers requests from covered entities and business associates that ask how your controls map to the HIPAA Security Rule. The PHIPA report serves Ontario health information custodians and their vendors under Canadian provincial privacy law. Before selecting either, check which assessment factors the report requires and whether your existing e1, i1 or r2 scope covers the systems that handle health data. Ask HITRUST which compliance factor selection applies to each.
Federal contractor and CUI requests
The NIST SP 800-171 report answers defense and federal contract clauses that require controls for controlled unclassified information in nonfederal systems. The CMMC Level 1 report targets the foundational practices for federal contract information. Check whether your CUI boundary matches the systems in your validated assessment scope, since a mismatch is a common reason an insights report does not reflect the environment a buyer cares about. Confirm the current report contents with HITRUST.
Ransomware and resilience requests
The Ransomware report responds to customers and insurers asking how your controls address ransomware risk. It draws on the validated results in your e1, i1 or r2 assessment rather than a separate test. Use it when a buyer's questionnaire focuses on backups, recovery and attack prevention. Confirm with HITRUST which requirement statements feed the report, so your readiness work covers the controls it reads.
State and government program requests
The NY OHIP report serves New York health organizations and their vendors that must demonstrate alignment with New York state requirements. The GovRAMP report supports state and local government vendors that must show security controls for cloud services. Check which government customer or program requires the report, because the requesting body often names the exact version or scope it accepts. Ask the requester for their acceptance criteria in writing before you plan the assessment.
Healthcare sector program requests
The HICP report aligns with the Health Industry Cybersecurity Practices guidance that hospitals and health systems often use to set expectations for their suppliers. The HPH CPG report maps to the healthcare and public health cybersecurity performance goals. Both suit vendors whose customers ask for a sector-specific view rather than a general security framework. Confirm with HITRUST how each report maps to the current publication before deciding whether it answers the buyer's question.
AI risk management requests
The AI Risk Management report repackages results from the HITRUST AI Risk Management Assessment, which is not a certification. Pursue it when a customer or regulator asks how you govern AI risk, not only how you secure AI systems. Its content draws on the harmonized AI risk controls, so it does not replace an AI security certification. Confirm the scope and the prerequisites with HITRUST before you link it to any existing e1, i1 or r2 result.
How a HITRUST result becomes an Insights Report
An Insights Report is only as strong as the validated assessment behind it. The chain starts with an e1, i1 or r2 assessment performed by an Authorized HITRUST External Assessor organization. The assessor tests the organization's controls, submits the validated assessment, and HITRUST performs central quality assurance before any report issues. Only after that review does the Insights Report exist, because it is derived from validated results rather than from a separate review. Your organization owns its controls, your implementation partner (if you use one) prepares systems and evidence, and the independent assessor and HITRUST are the only parties whose outputs carry weight with a regulator or customer. Confirm this sequence with your assessor before planning dates, since the Insights Report cannot be requested ahead of the validated result.
For e1 and i1, the mapping has an extra condition. The combined assessment must include the relevant compliance factor selected for the target framework, such as HIPAA, NIST SP 800-171 or CMMC Level 1. Ask your assessor which factors are in scope at the start of the engagement, because adding a factor after fieldwork is a scoping change, not a paperwork step. An r2 assessment is tested against its tailored requirement set, so confirm with the assessor how the target framework's requirements sit inside that tailoring before fieldwork begins. The Insights Report then reflects whatever the validated assessment covered and no more.
The mapping does not create new testing. Nothing in the Insights Report is re-examined, so a gap in the source assessment appears in the Insights Report as the same gap, expressed in the other framework's terms. If a requirement was scored low or not met in the e1, i1 or r2, the corresponding framework line will show that result. Plan remediation against the validated assessment's findings, not against the Insights Report's wording, and ask the assessor which corrective actions would change the mapped result before the next reporting cycle. Treat the Insights Report as a faithful repackaging of your evidence, and budget for evidence quality in the source assessment accordingly.
How an assessor treats an Insights Report request
This table shows how an External Assessor typically checks an Insights Report request, from confirming the source assessment to tracing the evidence behind each mapped result. Read it as a checklist to raise with your assessor before fieldwork starts, not as a fixed test script. The main takeaway is that an Insights Report is only as strong as the validated e1, i1 or r2 result it repackages.
| Check | What the assessor confirms | Evidence requested |
|---|---|---|
| Scope confirmation | The requested framework, such as HIPAA, NIST SP 800-171 or CMMC Level 1, is one of the ten Insights Reports HITRUST offers and matches the organization's stated scope. | Written request naming the Insights Report, the in-scope systems and business units, and the source assessment identifier. |
| Source validated assessment | The Insights Report depends on a validated e1, i1 or r2 assessment performed by an Authorized HITRUST External Assessor and submitted for certification. | Current validated assessment report, certification status and the assessor's engagement record. |
| Compliance factor for e1 and i1 | For e1 and i1, the relevant compliance factor was selected in a combined assessment. An assessor cannot map the report if the factor was not part of the original scope. | Assessment scope document showing the selected compliance factor, plus the combined assessment record. |
| Fieldwork window | The validated fieldwork for the source assessment ran within the 90-day maximum window in the Assessment Handbook, so the mapped results describe one consistent period. | Fieldwork dates, sampling periods and the assessor's timeline for the source assessment. |
| Evidence behind source results | Each mapped result traces back to a scored requirement statement in the source assessment, with the same evidence that supported that scoring. | Evidence index linking source requirement results to policies, configurations, logs and sampled records. |
| Changes after certification | Significant changes, security incidents or a CSF version update since the source assessment do not invalidate the mapping without review. | Change log, incident register and any assessor determination on whether the source results still apply. |
| Report wording and relationship to certification | The Insights Report is presented as an add-on that restates certified results in another framework's terms, not as a separate certification. | Draft report language reviewed by the assessor, confirming it does not claim certification to the other framework. |
| Handling of gaps | Requirements that were not met or not in scope are shown as such, and the assessor does not fill them with assumed results. | Corrective action plans, scope exclusions and any notes on unmet requirements from the source assessment. |
| Exact procedure | The step-by-step test approach and any additional checks are set by the External Assessor and HITRUST quality assurance, not by this table. | Confirm the procedure, deliverables and timing with your External Assessor in writing before engagement. |
Steps to plan for an Insights Report
The sequence runs from confirming the framework the request names to receiving the Insights Report, and each step produces a written artifact so the buyer can show how the report was earned. Because Insights Reports are mapped from a validated assessment, the order matters: the source assessment and its scope must be settled before any report is requested.
Confirm the framework the request names
Start by reading the customer, contract or regulator request and identifying the exact framework and version it cites. HITRUST offers ten Insights Reports, including HIPAA, NIST SP 800-171, CMMC Level 1 and GovRAMP, so the request must match one of them. Ask the requester whether they need a specific report or a general statement of alignment, because the answer changes the work. The output is a one-line written statement naming the framework, the requesting party and the document they will accept. If the framework is not on HITRUST's list, confirm with the requester that an Insights Report is the right vehicle before continuing.
Choose the source assessment level
Insights Reports are mapped from a validated e1, i1 or r2 assessment, so the source level must be chosen next. Compare how much of the organization's environment the assessment must cover, how long the certification must stay current, and how the target framework's requirements map to HITRUST's control set. Document the choice and the reasoning, because it determines the certification cycle and the cost of renewal. The output is a short decision record naming the e1, i1 or r2 assessment and the reason it was selected.
Decide whether e1 or i1 needs the compliance factor
If the chosen source is e1 or i1, the Insights Report requires a combined assessment with the relevant compliance factor selected. This is a scoping decision that must be made before the assessment begins, not after results arrive. Confirm with the External Assessor which factor applies to the framework named in step one and whether the combined assessment covers the same systems and locations as the rest of the scope. The output is a written confirmation of the factor selection, signed off by the organization's assessment owner.
Agree the assessment scope with the External Assessor
Only an Authorized HITRUST External Assessor organization can perform a validated assessment submitted for certification, so the scope agreement is made with that assessor, not with a consultant or implementation partner. Define the systems, facilities, business units and third parties in scope, and record which inherited controls will be relied on. The organization owns the scope decision. A readiness partner can help prepare the inventory and evidence, but the assessor confirms the boundary. The output is a written scope statement that the assessor and the organization have both accepted.
Complete the validated assessment fieldwork
The assessor performs the validated assessment against the agreed scope, testing policies, procedures and implemented controls and collecting the evidence that supports each requirement statement. The organization's job is to make evidence available, answer questions and track any findings or corrective actions raised during fieldwork. The validated assessment fieldwork window is at most 90 days for e1, i1 and r2, so the team should plan evidence collection with that limit in mind. The output is a completed validated assessment ready for submission, with the assessor's findings recorded.
Receive the certification after HITRUST quality assurance
After the assessor submits the validated assessment, HITRUST performs central quality assurance before it issues the report. Only then does the organization hold a certification at the level it selected. Confirm the certification's validity period with the assessor, since e1 and i1 certifications last one year and r2 certifications last two years, with an r2 interim assessment due in the 90 days before the first anniversary. The output is the issued HITRUST certification report, which is the basis for every Insights Report that follows.
Request the Insights Report
With the certification in hand, request the Insights Report for the framework named in step one. The Insights Report repackages the certified results in that framework's terms and is an add-on, distinct from the certification itself, so it does not replace the certification. Check that the report reflects the same scope the requester will rely on, and confirm how it will be shared under the organization's own disclosure rules. The output is the Insights Report, delivered to the requester with a short cover note that states the source certification and its validity date.
Who does what before a report can be issued
The organization that wants an Insights Report owns the outcome. It decides which e1, i1 or r2 assessment supports the report, defines the assessment scope, and remains accountable for the controls and the evidence behind them. Insights Reports are mapped from validated results, so the organization must first hold a validated e1, i1 or r2 assessment. For e1 and i1, the relevant compliance factor must be selected within a combined assessment. Management also decides which frameworks matter to its customers and regulators, since that choice determines which report to request.
- Scope decisions: Choose the systems, business units and locations that fall inside the assessment boundary.
- Control ownership: Assign a named owner to each control area so someone can answer for it during fieldwork.
- Evidence custody: Keep logs, approvals, tickets and configuration records accessible and unaltered.
- Factor selection: Confirm the compliance factor for the target Insights Report before the combined assessment begins.
- Sign-off: Review what the organization is attesting to and who may receive the report.
Before committing, confirm which framework report your customers actually request and whether the organization already holds the required validated result.
An implementation partner such as DeployOpen can help the organization get systems, controls and evidence ready for assessment. Work of this kind is often outsourced because it is labor-intensive: configuring logging, documenting procedures, closing gaps and organizing evidence in a form the assessor can sample. The partner acts in support of the organization. It does not hold the assessment, does not score the controls, and does not issue reports or certificates.
- Readiness work: Identify gaps between current controls and the requirements the chosen assessment will test.
- Platform preparation: Deploy, harden and configure the self-hosted open-source platforms that produce evidence, inside the organization's own infrastructure.
- Evidence packaging: Organize configurations, logs and records so the assessor can trace each control to its proof.
- Documentation: Draft procedures and runbooks, which the organization must review, approve and adopt.
- Written scope: Agree deliverables and timelines in writing before work starts, so the boundary between preparation and assessment is clear.
Ask any partner to state in writing that it will not perform the validated assessment or sign any report.
Only Authorized HITRUST External Assessor organizations may perform the validated assessments submitted for certification. The assessor tests the organization's controls, samples evidence and scores results within a fieldwork window of at most 90 days for e1, i1 and r2. Its independence is the reason its results carry weight, so it must not design or implement the controls it tests for the same engagement. An organization can check whether an assessor is authorized on HITRUST's Find an External Assessor page.
- Independent testing: The assessor samples evidence and tests whether controls operate as described.
- Scoring: Results are scored against the requirement statements for the assessment type.
- Submission: The assessor submits the validated assessment for review.
- Boundary with preparation: If the same firm prepared the controls, confirm with the assessor and HITRUST whether that arrangement affects independence.
- Fees: Assessor fees are paid by the organization and are set in the assessor's own engagement letter.
Ask the assessor to confirm its authorization status and how it handles independence before signing.
HITRUST performs central quality assurance on submitted validated assessments before results are issued. It does not perform the fieldwork, but it reviews the work of the assessor to confirm the results meet its requirements. The Insights Report is then produced from the validated result, repackaging the certified outcome in another framework's terms. This is distinct from the certification itself, so an organization should understand that the Insights Report is an add-on and not a separate assessment.
- Quality assurance: HITRUST reviews submitted validated assessments centrally before results are issued.
- Report production: The Insights Report is mapped from the validated e1, i1 or r2 result.
- Assessor directory: Authorized assessors are listed on HITRUST's public directory.
- Handbook rules: Assessment procedures, fieldwork windows and certification periods follow the HITRUST Assessment Handbook.
- Version currency: Confirm which CSF version applies to the assessment you plan, since versions change over time.
Before planning, read the Assessment Handbook so the timing of quality review fits your contractual deadlines.
Evidence that carries over into an Insights Report
An Insights Report repackages results from a validated e1, i1 or r2 assessment, so it can only be as current as the evidence behind that assessment. The four areas below are the evidence an organization already produces for its source assessment, and keeping them maintained lets one report request be answered without rebuilding the record.
Scoped control inventory
The inventory records which requirement statements apply to the organization, which systems and locations they cover, and which were marked not applicable and why. For e1 and i1 the requirement set is fixed, so the inventory mainly shows where each statement is met. For r2, the tailored set drives every compliance factor an Insights Report maps against. Check that the inventory is reconciled to the scope statement in the assessment, since a mismatch between the two invites questions from the assessor and from any relying party reading the mapped report.
Policy and procedure documents
Policies set intent, and procedures show how staff carry out the control day to day. Each document should carry an owner, an approval date, a review cycle and a version history that matches what was in force during the assessment window. A mapped report is only as defensible as the documents it cites, so confirm that each policy referenced for a framework such as HIPAA or NIST SP 800-171 is the same version the assessor sampled, and that updates made after fieldwork are tracked as changes rather than silently replacing the original.
Implementation records for each requirement
Implementation records prove a control operated, not just that it was designed. Examples include access review exports, configuration baselines, change tickets, vulnerability scan results, training completion logs and backup restore tests. Each record should be linked to the requirement statement it supports and carry a date and an identifiable source system. Insights Report mappings rely on the same records, so a single well-indexed record can serve the source assessment and several framework requests at once, provided it stays within its retention window.
Evidence kept between assessments
Between assessments, the organization must keep evidence flowing: recurring reviews, incident logs, corrective action updates and monitoring outputs. Gaps in this period are the usual reason a refreshed report cannot be produced from the earlier assessment record. Assign an owner to each recurring evidence stream, set a collection calendar, and store outputs in a location that retains them for the full certification period. Confirm with the assessor which intervals and sampling rules apply, since these determine how far back evidence must reach.
What the Insights Report adds to the cost of a HITRUST assessment
This table separates the cost lines of an Insights Report from the underlying validated assessment, so you can see what the add-on changes and what it leaves untouched. Read it as a checklist for the quote: ask for each line separately, and confirm whether it recurs. The main takeaway is that the Insights Report is mapped from a validated e1, i1 or r2 result, so most of the cost sits in the assessment itself.
| Cost component | Who is paid or who spends effort | One-time or recurring | What drives it and what to ask for |
|---|---|---|---|
| Underlying validated assessment | Authorized HITRUST External Assessor, per written quote | One-time per assessment cycle | Scope size and assessment level. Ask for the fee for the e1, i1 or r2 separately from any Insights Report line. |
| Insights Report add-on | HITRUST, per its current fee schedule | Per report produced | Number of reports and which framework each maps to. Confirm whether the fee is listed separately and whether it is charged per report or per assessment. |
| Compliance factor selection | Assessor and internal team, during scoping | One-time per scope definition | For e1 and i1, the Insights Report requires a combined assessment with the factor selected. Ask how the factor changes the assessor's testing hours. |
| Internal staff time for scoping and evidence | Your own compliance, IT and security staff | Recurring each assessment cycle | Number of systems in scope and evidence maturity. Estimate internal hours before the quote so the budget covers them. |
| Readiness work | Consultant or readiness provider, per written scope | One-time before the assessment | Gap between current controls and requirement statements. Ask for a readiness scope that names which Insights Report frameworks it covers. |
| Evidence collection for each mapped framework | Your internal team, with any help from the assessor or consultant | Recurring if the report is refreshed | Overlap between the mapped framework and the HITRUST requirements. Ask the assessor which evidence is shared and which needs separate artifacts. |
| Renewal and interim assessment | Assessor, per written quote for the next cycle | Recurring at each renewal | Certification term of one year for e1 and i1, two years for r2. Confirm whether the Insights Report must be reissued at each renewal. |
Common gaps that stop an Insights Report from being useful
Can we request an Insights Report before our source assessment is certified?
No. An Insights Report repackages results from a validated e1, i1 or r2 assessment, so the source assessment has to exist and be certified before the report can be meaningful. HITRUST describes Insights Reports as add-ons that restate certified results in another framework's terms, which is separate from the certification itself. Requesting a report early usually means paying for a document that has nothing solid behind it and having to rework it later. To close this gap, confirm the certification status and its expiry date first, then plan the report request as a step after the validated assessment is complete. Ask your assessor and HITRUST's process owners to confirm the sequence for your specific engagement, since timing depends on your assessment cycle and where your certification sits in its one-year or two-year term.
How do we pick the right Insights Report when a customer asks for several frameworks?
Match the report to the framework named in the written request, not to the framework your team knows best. HITRUST offers ten Insights Reports, including HIPAA, PHIPA, NIST SP 800-171, CMMC Level 1, Ransomware, NY OHIP, GovRAMP, HICP, HPH CPG and AI Risk Management. Each one answers a different question, so a customer asking about defense contract security needs a different report from one asking about HIPAA alignment. Before ordering, collect the exact framework names, versions and any specific questions from each requester. Where requests overlap, a single source assessment can support several reports, but each report must be ordered and read against its own framework. Confirm with the requester that the report they receive is the one their contract or regulator actually references.
What happens if we skip the compliance factor on an e1 or i1 assessment?
You may not be able to produce the Insights Report at all. HITRUST's documentation states that for e1 and i1 assessments, Insights Reports require a combined assessment with the relevant compliance factor selected. If the factor is missing when the assessment is scoped, the mapping to the other framework cannot be built from the results you hold, and fixing it later can mean extra assessment work. The e1 has 44 requirement statements and the i1 has 182 in v11.9, and the compliance factor determines which statements are relevant to the target framework. Before fieldwork starts, ask your external assessor to confirm in writing which compliance factors are selected and which report they support. Treat that confirmation as a scoping deliverable, not an afterthought.
Why does scope drift between the assessment and the customer request cause problems?
A report can only describe the systems, facilities and processes that were in the validated assessment scope. When a customer asks about a product line, cloud account or business unit that the assessment never covered, the report cannot honestly speak to it. Scope drift often starts with a sales commitment, a new subsidiary or a new hosting environment that nobody added to the assessment boundary. To close the gap, compare the written scope statement in the assessment with the wording in each customer request before ordering. Maintain a short scope register that records any changes, and involve your assessor early if a new environment must be covered. Where the gap is material, the honest fix is usually a scope update or a separate assessment rather than a broader claim in the report.
Can an Insights Report replace a HITRUST certification in our contracts?
No. An Insights Report is an add-on that presents validated results in another framework's terms, and it does not substitute for the underlying e1, i1 or r2 certification. Some contracts and questionnaires ask for a report without naming the certification, and a team may be tempted to send the report alone. Recipients who understand HITRUST will look for the certification status, its scope and its expiry date, and an unsupported report can damage trust. Make the certification the primary document in any disclosure, and present the Insights Report as the framework-specific view built on top of it. If a counterparty asks for something the certification does not cover, confirm the gap with the counterparty and your compliance lead before offering alternatives.
Who is responsible for producing and checking an Insights Report?
Your organization owns the controls, the scope and the decision to share results. An implementation partner such as DeployOpen can help prepare systems, documentation and evidence, but DeployOpen does not issue audit reports, attestations or certifications. Only an Authorized HITRUST External Assessor organization performs the validated assessment submitted for certification, and HITRUST performs central quality assurance before issuing reports. Ask your assessor to explain which parts of the Insights Report they validate and which parts you prepare, and confirm that the final wording comes from the official HITRUST output. Keep a record of who reviewed the mapping and who approved sharing it with each requester.
How DeployOpen prepares your systems and evidence for a HITRUST Insights Report
DeployOpen works on the systems and evidence behind a HITRUST Insights Report, not on the report itself. Our role is to prepare the self-hosted open-source platforms and control evidence inside your own infrastructure so that a validated e1, i1 or r2 result can be mapped to the other framework your customer or regulator asks about. Only an authorized HITRUST External Assessor and HITRUST can issue the reports.
How we scope
- We agree a written scope that names the Insights Report, the underlying e1, i1 or r2 assessment and the compliance factor selected.
- The scope lists which platforms, environments and control areas we will prepare, and which remain with your team or your assessor.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work starts; a quote follows from that scope.
How we build
- We configure and harden the self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks to meet the scoped requirements.
- We set up logging, access records, change records and backups so each requirement can produce evidence that an assessor can sample.
- We test the controls against the scoped requirements and document gaps, so your team can close them before the validated assessment begins.
How we hand over
- We document the configuration, control ownership and evidence locations so your team can show how each requirement is met.
- We prepare an evidence index that maps each supporting artifact to the requirement it addresses, for your assessor to review.
- We train your staff to run the platforms and produce evidence, and we confirm the handover in writing before the engagement closes.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the engagement closes.
- We can update the evidence and configuration when your e1, i1 or r2 assessment is renewed or when the CSF version changes.
- Your organization decides which Insights Report to pursue and which assessor to engage, and confirms each mapping with that assessor.
