How much does HITRUST certification cost, and what changes the number?
If a customer or contract now requires HITRUST certification, the first thing to know is that HITRUST does not publish prices. Its assessment pages direct buyers to request information or contact sales, so the number comes from building up the components yourself and then asking for quotes against a written scope. The total is typically made of four parts: the Authorized HITRUST External Assessor's fee, your MyCSF subscription, the charges for HITRUST's report and quality assurance, and any readiness work you pay someone to do beforehand. The organization owns its controls and its certification decision. DeployOpen, where engaged, prepares systems and evidence under a fixed written scope. Only an Authorized HITRUST External Assessor performs the validated assessment, and HITRUST issues the certification after its own quality review. Those roles are separate, and each one is a line item in the budget.
The assessment level and scope drive most of the variation. The e1 carries 44 requirement statements and the i1 carries 182 in CSF v11.9.0, so an i1 generally means several times the testing effort of an e1. The r2 is larger again because it adds tailored requirements on top of the i1 baseline. Scope adds to that: the number of systems, locations, business units and third-party services inside the assessed environment all change how much evidence an assessor must sample. Ask each firm to quote against the same named scope and level, and to state its assumptions about system count and sampling. Otherwise the quotes cannot be compared.
Recurring cost matters as much as the first year. An r2 is valid for two years but requires an interim assessment within the 90 days before the first anniversary, so the spend spreads over a full assessment plus an interim. e1 and i1 holders can lower year two effort with a rapid assessment that uses rapid sampling instead of a full reassessment. Inheritance can also reduce the requirements you test yourself when a cloud or platform provider already holds validated results, and that choice should be confirmed in writing with both the assessor and the provider. Before signing, ask each vendor for a quote that separates one-time from annual charges, confirms the MyCSF subscription terms, and states what happens to fees if the fieldwork runs past the 90-day window.
Who gets paid for what in a HITRUST certification
This table shows each cost component of a HITRUST certification, who receives the money, whether it is one-time or recurring, and what drives it. Use it to build a quote request that compares like with like. HITRUST does not publish prices, so confirm every fee schedule directly with HITRUST and the firms you consider.
| Cost component | Who is paid | One-time or recurring, and what drives it | What to request in a quote |
|---|---|---|---|
| External Assessor fees | The Authorized HITRUST External Assessor firm performing the validated assessment | Typically one-time per assessment cycle. Driven by assessment level, scope, number of systems and locations, and fieldwork effort. Fees are set by the firm, separate from HITRUST. | Itemized fee by assessment level, fieldwork hours or days, interim assessment pricing for r2, and what is excluded |
| HITRUST MyCSF subscription | HITRUST, through a subscription to its MyCSF platform | Recurring while the assessed entity uses the platform. Driven by the subscription tier and how long assessments are active. | Current subscription tiers, whether an assessment is covered for its full life, and renewal terms |
| HITRUST quality assurance and report charges | HITRUST, for central quality assurance and issuing the report and certification | Charged per submitted validated assessment. Driven by the assessment level and whether the work is an initial assessment or an interim or rapid assessment. | Current QA and report fees for each assessment type, and the timing of charges relative to submission |
| Readiness consulting or readiness licensee work | A consultant or Readiness Licensee, not the validated assessor | Usually optional and one-time per readiness exercise. Driven by the number of gaps, the maturity of existing controls and the scope of readiness review. | Written scope of readiness tasks, deliverables, and confirmation that the firm will not also perform the validated assessment |
| Implementation partner work on systems and evidence | An implementation partner such as DeployOpen, for systems, controls and evidence preparation | Mostly one-time for setup, with recurring work if evidence collection or upgrades continue. Driven by how many platforms are in scope and how much control work is missing. | Fixed-scope deliverables in writing, the controls and evidence covered, and who owns the resulting documentation |
| Internal staff time | Your own employees, through salary and opportunity cost | Both one-time and recurring. Driven by control owners, evidence collection frequency and fieldwork support. Staff who implemented or operated controls in the prior 12 months cannot work on the validated assessment. | An internal estimate of hours by role, with a plan for who answers assessor questions |
| Inheritance and shared responsibility work | Internal teams or the provider's compliance team | One-time to map inherited requirements, then recurring to confirm the provider's results stay current. Driven by how many requirements a provider's validated results cover. | The provider's current HITRUST report, scope letter, and shared responsibility matrix |
| Tooling and evidence platforms | Software vendors, including open-source projects that you run yourself | Recurring for licensed tools and hosting. One-time for installation and configuration. Driven by the number of systems and the evidence each control requires. | Licensing terms, hosting requirements, support options, and whether the tool produces evidence an assessor can review |
What makes a HITRUST assessment cost more or less
HITRUST certification cost is set less by the HITRUST platform than by how much your organization must test itself. Assessment level, scope, inheritance, evidence readiness, carve-outs and r2 tailoring each change the work an External Assessor performs and the work your team prepares, so each one is a lever you can plan around before a quote is requested.
Choosing the assessment level
The e1 carries 44 requirement statements and the i1 carries 182 in CSF v11.9, so moving from e1 to i1 multiplies the testing surface several times over. Ask which level a customer or contract actually names before scoping, because a higher level you do not need adds fieldwork, evidence and fees. Confirm with the requesting party whether an e1 or i1 satisfies the request and whether a later upgrade path is acceptable.
Defining the assessment scope
Scope decides which systems, facilities, business units and locations fall inside the validated assessment, and every added item adds evidence to collect and sample. Draw the boundary around the environment that actually stores, processes or transmits the data the requester cares about. Ask your assessor how scope changes affect fieldwork and fees, and document the reasons for any exclusions.
Inheriting results from providers
When a cloud platform or vendor holds its own HITRUST validated assessment, you can reuse those results rather than test the same requirements again. HITRUST's Oracle Cloud Infrastructure example rates physical security as highly inheritable, which can shrink your own testing burden. Ask the provider for its current certificate, its scope statement and a shared responsibility matrix, then confirm that the inherited controls match your deployment.
Evidence maturity and existing controls
Controls that already run consistently and produce dated records cost less to validate than controls that must be built or documented during the assessment. Before fieldwork, review whether policies, access reviews, change records and logs exist and cover the assessment period. Gaps found late tend to trigger corrective work, extra sampling and schedule slips, so a readiness review is often the cheapest place to find them.
Third-party carve-outs
A carve-out excludes a third party's controls from your own testing, which narrows scope but requires you to explain how those services are governed. Hosting providers, payroll processors and other vendors may be carved out when they are not in scope, but the choice must be documented and defensible to the assessor. Ask whether each carve-out is supported by the vendor's own validated results or by your contract oversight, since unsupported carve-outs can be challenged.
Tailoring the r2 requirements
The r2 builds tailored requirements on top of the i1 baseline, so the number of statements depends on how your organization's risk and the CSF factors are applied. Tailoring can add or change work, so ask the assessor to show the factor analysis and explain the resulting statement count before you commit. Because the r2 also requires an interim assessment within the 90 days before the first anniversary, plan for both assessments in the budget discussion.
Why the r2 cost spreads across two years
The r2 certification is valid for two years, but it is not a one-time purchase. HITRUST requires an interim assessment within the 90 days before the first anniversary of the certification. The cost of an r2 therefore has two parts: a full validated assessment in year one and an interim assessment in year two, each with its own External Assessor fieldwork, evidence review and reporting effort. When a customer asks what the r2 costs, the honest answer is a full assessment plus an interim, and budgeting only for the first assessment understates the commitment by a material amount.
e1 and i1 holders have a different year two. HITRUST's Assessment Handbook allows a rapid assessment in year two that uses rapid sampling instead of a full reassessment, which generally means a narrower evidence pull and less assessor time. Whether an r2 holder can use the same shortcut is a question to settle with the assessor and HITRUST's current rules before you commit to a multi-year budget, because the interim structure for r2 differs from the rapid path. Confirm the year two method in writing, since it changes the second-year figure more than almost any other input.
Ask the External Assessor to price year one and year two separately, and to state the sampling approach, the fieldwork window and the scope assumed for each. Ask which requirement statements and inherited controls the year two quote assumes are unchanged, and what happens if a significant change or a security incident forces broader testing. Also ask whether the readiness work, which recurs as your environment changes, is included in either year. A two-year number that is not split this way cannot be compared with a quote from another firm, and it hides the year two decision you will face.
How inheritance from a cloud provider lowers the bill
When your workloads run on a cloud platform that already holds a validated HITRUST assessment, you can reuse the results that cover the controls the provider operates. HITRUST's own example, using Oracle Cloud Infrastructure, rates physical security as highly inheritable, because a data center operator's controls are the same for every tenant and you cannot test them yourself in any useful way. Inheritance removes those requirements from your own fieldwork, but it does not remove the controls you run on top of the platform, such as identity configuration, data classification, logging and application security. Illustratively, a team that runs a managed database on a certified cloud may inherit the facility and hardware controls, then test only its own access reviews and backup restores.
- Inherited requirements: Facility, environmental and much of the infrastructure layer can be carried over, subject to the provider's validated scope and assessment date.
- Your retained requirements: Identity, configuration, encryption key management, monitoring and application controls remain yours to test.
- Shared responsibility matrix: Map each requirement to the provider, to you or to both, and document the split before fieldwork begins.
- Scope alignment: Confirm the provider's assessed services and regions match the services you actually use.
- Currency of the provider's report: Check the validity window and any interim or bridge status, since an expired provider result gives you nothing to inherit.
Before you rely on any inherited result, ask the provider for its current certification letter and its exact assessed scope, and confirm both with your External Assessor.
If your customers inherit controls from you, your own HITRUST assessment can reduce their testing burden and turn your certification into a sales asset. The cost you carry is the cost of making your results inheritable: your assessment must be clearly scoped, your shared responsibility documentation must be precise enough for customers to map their requirements, and your results must stay current. Your assessor will test the controls you claim, so a broad or vague scope invites disputes over what can be passed on. Illustratively, a platform vendor whose data center and infrastructure controls are assessed can let each customer skip re-testing those layers, while the customer still tests its own use of the platform.
- Clear scope statement: Define which services, locations and systems the assessment covers, so customers can see exactly what they can inherit.
- Responsibility documentation: Publish a matrix that tells customers which controls you operate and which they must operate.
- Current validity: Keep your certification and any interim assessment on schedule, because customers lose inherited coverage when yours lapses.
- Carve-out handling: Decide which subservice organizations you carve out and whether they carry their own results.
- Support load: Budget for customer questions about inheritance, which recur at every renewal and at each customer's own assessment.
Before you commit to becoming an inheritance source, ask your assessor how the inheritance will be presented in your report and what your customers will need to see to rely on it.
If your organization runs on infrastructure without a HITRUST-assessed provider, you have little or nothing to inherit, and the full requirement set falls on your own team and assessor. This is common for organizations that run self-hosted platforms in their own data centers or private cloud accounts. Cost in this situation is driven by breadth of testing rather than by reuse, so the assessment level and scope decisions matter more. Facility controls, hardware lifecycle and the physical environment are still yours to evidence, which means collecting access logs, maintenance records and environmental monitoring output for the assessment period. Illustratively, an organization running its own virtualized environment in a leased rack will test physical controls itself, although it may still inherit from the colocation provider if that provider holds a relevant assessment.
- Full test scope: Every applicable requirement in your chosen assessment must be tested directly, unless a supplied result covers it.
- Physical controls: Evidence facility access, visitor logs and environmental monitoring yourself, or confirm whether your colocation provider has results you can inherit.
- Evidence volume: Plan for more collection effort, because each control needs artifacts that cover the assessment period.
- Future reuse: Document your controls carefully now, since the same records can later support a customer who asks for inheritance from you.
- Partial inheritance options: Check whether any vendor you use has a HITRUST result, even if your main platform does not.
Before you sign a quote, ask the assessor to show which requirements it expects to test directly and which, if any, it would accept from a third party.
Where the cost is committed during a HITRUST project
The sequence shows which phases carry fixed external fees, which carry internal labor, and which recur later, so a buyer can see where money is committed before each gate is passed. Costs follow the order of the work, not the order of the invoices.
Decide whether to run a readiness assessment
The organization decides whether to commission a readiness assessment before the validated work starts. A readiness review is optional under HITRUST's process, and it is performed by a firm that is separate from the External Assessor that will later score the validated assessment. Readiness work is paid to the firm you hire, and its cost depends on how many controls you already evidence. The step closes when leadership has a written gap list and a decision on whether to fund remediation before scoping. Ask any readiness provider to state which HITRUST role it holds and whether its staff will be barred from the validated assessment.
Scope the assessment in MyCSF
The Assessed Entity creates and scopes the assessment in HITRUST's MyCSF platform, which it accesses through a subscription. Scope decisions set how many requirement statements apply, which systems and facilities are in the boundary, and whether any results will be inherited from a provider. The subscription is a recurring platform cost, and the scoping choices drive the size of the external fieldwork that follows. The step closes when the assessment is created and scoped in MyCSF and the scope is agreed with the External Assessor. Confirm with HITRUST which subscription tier and renewal terms apply to your assessment type.
Select and engage an External Assessor
The organization contracts an Authorized HITRUST External Assessor organization to perform the validated assessment. This is the only fee in the sequence that is paid to the independent party whose work HITRUST will rely on, and the firm sets its own fees separately from HITRUST. The engagement letter should state scope, staffing, the fieldwork plan and how the firm will handle the requirement that staff who helped implement the controls cannot test them. The step closes when the signed engagement covers the scoped assessment, and the firm has confirmed the QA reservation timing. Request a written fee breakdown that separates fieldwork, report preparation and any re-testing.
Complete fieldwork within the 90-day window
The External Assessor tests evidence and samples the controls over a validated assessment fieldwork window of at most 90 days. The organization supplies policies, system configurations, logs and interview access, and internal staff spend time answering evidence requests, which is an internal labor cost. Remediation of any failed requirements during this window adds cost that is not covered by the assessor's fee. The step closes when the assessor has completed testing, scored each domain and submitted the assessment for quality assurance. Ask how many evidence requests are expected and how re-testing is priced if a control fails.
Wait for HITRUST quality assurance
HITRUST performs central quality assurance on the submitted assessment before it issues a report. HITRUST states a quality assurance service level of 30 days for e1 and 45 days for i1 validated assessments, and says the next report credit is complimentary if it misses that level. This step is paid for through the HITRUST report and assessment fees, not the assessor's fee, and the organization often pays for assessor time while waiting for a response. The step closes when HITRUST accepts the assessment or returns questions that the assessor must resolve. Confirm your reservation date with HITRUST and plan staff and assessor availability around it.
Review the draft report and certify
HITRUST issues a draft report that the organization reviews for accuracy before the certification is finalized. Disputes about scoring or wording are resolved through the assessor and HITRUST, and any corrective action or rework extends the schedule and adds external fees. Once the report is final, HITRUST issues the certification letter and the report can be shared with relying parties. The step closes when the certification is issued and the organization records its expiry date. Confirm which report and letter types you will receive, and what the certification is valid for under your assessment type.
Fund the year-two or interim step
The cost does not end at certification. e1 and i1 holders can lower year two cost with a rapid assessment that uses rapid sampling instead of a full reassessment. An r2 certification is valid for two years but requires an interim assessment within the 90 days before the first anniversary, so its cost is spread across a full assessment and an interim. These are recurring costs that repeat on the certification cycle, and they should be budgeted from the start. The step closes when the organization has a costed plan for the next assessment and has confirmed the eligibility rules for rapid or interim work. Ask the assessor and HITRUST to quote the recurring phase in writing before signing the first engagement.
Readiness work that lowers surprise costs
Most extra assessor days come from gaps that surface during fieldwork, not from the assessment itself. The cards below cover the readiness steps that find those gaps early, keep the readiness team separate from the validated assessment, and give the External Assessor evidence that can be checked quickly.
Define scope before spending
Scope decides how many requirement statements the assessor tests, so it is the first cost lever. Decide which systems, facilities, data flows and business units sit inside the boundary, and which will be carved out or inherited from a provider. Ask the assessor and your readiness partner to review the scope in writing before controls are tested, since a boundary change late in the process usually means re-testing.
Run a control gap review
A gap review compares your current controls against the requirement statements for the assessment level you are pursuing. It shows which statements already have operating evidence, which have a policy but no proof of operation, and which have nothing. Fixing gaps before fieldwork costs far less than discovering them when the assessor requests samples and the answer is not yet in place.
Allow the incubation period
HITRUST expects systems and controls to operate for a period before the validated assessment, so a control implemented a few weeks before testing rarely has the history an assessor needs. Build the incubation window into the plan and confirm with your assessor how it applies to each control you changed. Starting too late turns an incubation requirement into a delay that pushes fieldwork and report dates back.
Separate readiness and assessment teams
Personnel who helped implement or operate the controls during the prior 12 months cannot work on the validated assessment. If your readiness consultant also built the controls, a different team or assessor staff member will need to test them, which can add onboarding time and cost. Ask consultants and assessors to confirm independence in writing before scoping begins.
Build a documented evidence library
An evidence library maps each requirement statement to the policy, configuration export, log, ticket or record that shows the control operating, with a named owner and a date. Assessors spend less time locating and interpreting evidence when it is indexed this way. Confirm the format your assessor expects and whether the library should live in MyCSF or in your own repository.
Check inheritance claims early
Inherited results from a cloud or hosting provider can remove requirements you would otherwise test yourself, but only when the provider's assessment covers the service you use and the scope matches. Request the provider's assessment letter and responsibility matrix during readiness, then confirm with your assessor which statements the inheritance covers. Unverified inheritance claims are a common source of rework late in the process.
Who owns the controls, who prepares evidence and who certifies
Your organization owns the controls, the risk decisions and the operating evidence. No outside firm can accept responsibility for a control that your staff run every day, and the validated assessment tests what your people actually do. Internal cost is mostly staff time, and it recurs because controls must keep operating between assessments.
- Control ownership: Named owners for each domain, who decide policy, accept residual risk and answer for outcomes.
- Scoping decisions: Choosing the assessment level, the systems in scope and which cloud or vendor services can be inherited.
- Operating evidence: Access reviews, change records, logs, training records and vendor reviews that exist before the assessor arrives.
- Assessor liaison: Providing population lists, system owners for interviews and timely responses during fieldwork.
- Independence planning: Keeping staff who helped implement or operate controls in the prior 12 months off the validated assessment team.
Before you request a quote, confirm which of these roles your own staff can fill and which need dedicated time.
An implementation partner helps prepare the environment and the evidence so that controls are in place and documented before the validated assessment starts. DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and prepares systems, controls and evidence for compliance assessments. It does not issue HITRUST reports, scores or certificates.
- Readiness preparation: Gap work against the requirement statements in scope, with remediation of technical settings and documentation.
- Platform build: Configuring logging, access controls, backup, patching and monitoring on systems you own.
- Evidence preparation: Structuring records so an assessor can sample them, such as configuration baselines and change logs.
- Documentation: Procedures and runbooks that describe how controls operate, written for your environment.
- Fixed-scope delivery: Scope, deliverables and timelines agreed in writing before work starts, with a quote that follows from that scope.
Ask the partner to state in writing which tasks it will perform and that it will not perform the validated assessment or sign any HITRUST deliverable.
Every validated assessment must be performed by an Authorized HITRUST External Assessor organization. That firm tests your controls independently, scores them and submits the work through MyCSF. Its fees are separate from HITRUST's and are set by the firm, so the assessor usually accounts for the largest external line in the budget. Fieldwork runs within a window of at most 90 days for e1, i1 and r2.
- Independent testing: Sampling, interviews and evidence review performed by the assessor's own staff.
- Scoring: The assessor scores each requirement and submits the assessment for review.
- Fee structure: Quoted by the firm based on assessment size, scope and timing, so compare quotes on the same scope.
- Independence rules: The assessor's team cannot have helped implement the controls it tests within the prior 12 months.
- Readiness versus validation: A firm that also consults on readiness may need a separate team for the validated work.
Confirm the firm appears in HITRUST's external assessor directory and ask who will sign the submission.
HITRUST does not perform your assessment, but it runs central quality assurance on every validated submission before it issues a report or certification. Its quality review is the step that turns an assessor's scored work into a certification. HITRUST also sets the CSF, the assessment rules and the MyCSF platform through which you access and submit the work under a subscription.
- Quality assurance: Central review of each validated submission before a report is issued.
- Service levels: HITRUST commits to a quality assurance service level of 30 days for e1 and 45 days for i1 validated assessments.
- Platform access: MyCSF subscriptions are a separate, recurring cost paid to HITRUST.
- Report and certificate issuance: HITRUST issues the report and letter once quality assurance is complete.
- Rules and versions: The CSF version and assessment handbook that apply to your submission.
Confirm current MyCSF subscription terms and QA service levels directly with HITRUST, since these can change between CSF versions.
What usually inflates a HITRUST budget
Most HITRUST overruns trace back to a few avoidable decisions made before fieldwork starts. The cards below cover scope, inheritance, evidence, team separation, the r2 interim and calendar windows, so you can ask the right questions in a quote.
Unclear scope that grows
When the boundary of the assessed environment is not fixed in MyCSF before fieldwork, requirement statements, systems and sample populations get added mid-assessment. Each addition means more evidence to gather and more hours for the External Assessor to test. Before you sign, ask the firm to walk through the systems, locations, business units and third parties in scope, and confirm in writing which ones are excluded and why.
Scoping without inheritance mapping
If you do not map which controls a cloud provider or other vendor already covers through its own validated HITRUST results, you may test requirements that were never yours to prove. Build a shared responsibility matrix during scoping and confirm which inherited results apply to your assessment. Ask your assessor how inheritance will be documented and accepted before the assessment is created.
Poor evidence forcing retesting
Evidence that is incomplete, unlabeled or drawn from the wrong period sends the assessor back to the control owner, and every round trip adds delay and billable time. Define the evidence for each requirement, the date ranges it must cover and the naming convention before testing begins. Use a sample of your own evidence in a readiness review to find gaps early.
Using the assessor for readiness
Personnel who helped implement or operate the controls in the prior 12 months cannot work on the validated assessment. If the same firm runs your readiness work and then tests the controls it helped build, you may need a separate team or a second firm for fieldwork, which adds cost. Ask any firm you approach whether it offers readiness work and how it separates those teams.
Underestimating the r2 interim
An r2 certification is valid for two years, but an interim assessment is due in the 90 days before the first anniversary. Teams that budget only for the initial assessment often find the interim requires its own fieldwork, evidence refresh and assessor time. Ask for a quote that prices both the full assessment and the interim, and confirm whether the interim is scoped separately.
Missing QA and fieldwork windows
Validated fieldwork must fit within a window of at most 90 days, and HITRUST quality assurance follows its own service levels. Missing these windows can push the report into later periods, extend project management fees and delay the certification your customer is waiting for. Confirm your target dates against the fieldwork window and the published QA service levels, and reserve QA time as part of planning.
HITRUST cost questions buyers ask before hiring help
How much does a HITRUST certification cost?
HITRUST does not publish prices on its public assessment pages, so there is no list figure to quote. The cost is built from several separate fees: the External Assessor's fee for the validated assessment, HITRUST's own fees for the MyCSF subscription and report work, any readiness support you buy, and the internal staff time your team spends on evidence. The assessor sets its own fee, so ask each firm for a written quote based on your assessment level, scope and number of systems. Ask each quote to show which items are one-time and which recur. Any figure you see quoted elsewhere should be checked against the current HITRUST and assessor documentation before you budget.
Can we run a HITRUST assessment ourselves?
Your organization can prepare its own controls and evidence, but it cannot self-certify. Every validated assessment must be performed by an Authorized HITRUST External Assessor organization, and HITRUST performs quality assurance before it issues a report. Your team will need a MyCSF subscription, which is where the assessment is created, scoped and submitted, and people who can own the scoping decisions, answer requirement statements and produce evidence. Also confirm that anyone who helped implement or operate the controls in the prior 12 months is not on the validated assessment team, because the assessment rules require separate people for that work.
What does the r2 interim assessment cost?
The r2 is valid for two years and requires an interim assessment within the 90 days before the first anniversary, so its cost is spread over the full assessment and the interim. HITRUST does not publish the interim fee, so request it as a separate line in your assessor quote rather than assuming it matches the original fee. Ask the firm what the interim covers, how much testing it repeats, and whether it is priced as a fixed scope. Your internal evidence collection and any HITRUST platform costs also recur, so include them when you compare the two-year total.
Does hiring a consultant reduce the assessor fee?
No. A consultant's readiness work and the External Assessor's validated assessment are separate engagements with separate fees. Readiness work helps you find gaps and prepare evidence before fieldwork, which can reduce rework and the time your team spends during the assessment, but the assessor still charges for the validated work. Some readiness consultants are not permitted to perform the validated assessment at all, so confirm which firm will do each part. Ask any consultant to state in writing what its work does and does not cover.
What drives year-two HITRUST cost?
Year-two cost depends on whether you are on an e1 or i1, which can use a rapid assessment with rapid sampling instead of a full reassessment, or on an r2, which needs an interim assessment in its second year. The main drivers are the scope you carry forward, how much of your environment changed, whether you can inherit validated results from a provider such as a cloud platform, and how well your evidence stayed current during the year. Significant changes, security incidents and CSF version updates can also add work. Ask the assessor which of these apply to your situation before you agree to a year-two budget.
Does DeployOpen issue the HITRUST certificate?
No. DeployOpen plans, implements, hardens and documents the self-hosted open-source platforms in your own infrastructure, and it can prepare systems, controls and evidence for an assessment. It does not perform validated assessments, issue reports or issue certificates. Only an Authorized HITRUST External Assessor performs the validated assessment, and HITRUST performs quality assurance before issuing the report and certification. Your organization owns its controls and decides which assessor to engage.
How do we compare HITRUST quotes fairly?
Compare quotes only when each one covers the same assessment level, the same scope and the same number of systems. Ask every firm to list the assessor fee, readiness work, platform or subscription costs you will pay directly, the r2 interim fee if relevant, and any year-two rapid or interim pricing. Check whether each firm is an Authorized HITRUST External Assessor by searching HITRUST's directory, and confirm the fieldwork window and quality assurance timing in writing. Fixed-scope proposals with agreed deliverables and dates make differences in price easier to see than open-ended hourly estimates.
What to ask for in a HITRUST quote
A comparable HITRUST quote should state the assessment level (e1, i1 or r2), the requirement count it covers, and the scope in writing: which systems, facilities, data flows and business units are in, and which are out. For the e1 and i1, the requirement count is fixed by the CSF version in use, and the current v11.9.0 baseline lists 44 e1 and 182 i1 requirement statements. For the r2, ask how many tailored requirements are added on top of the i1 baseline and who decided them. Ask the quote to name the inheritance assumptions too: which cloud or hosting provider results are being relied on, which controls are carved out, and what evidence the organization must still supply for its own controls. A quote that prices the assessment without stating these assumptions can change materially once the assessor starts fieldwork.
Next, separate the fees. The external assessor's fieldwork fee is set by the assessor firm and is not paid to HITRUST, so ask for fieldwork days, the number of assessor staff, and the fieldwork window. HITRUST's rules cap the validated fieldwork window at 90 days, and the quote should show how that window is planned. Then ask for HITRUST's own charges separately, including the MyCSF subscription, the quality assurance reservation, and any report or add-on fees, and confirm whether HITRUST currently publishes those prices or whether they must be requested. For a two-year r2, ask for the interim assessment price or a stated method for calculating it, and for the e1 and i1, ask what a rapid assessment in year two would cost compared with a full reassessment.
Finally, ask what the implementation partner will deliver in writing. DeployOpen does not publish a price list. A quote follows from a written scope that lists the deliverables, such as gap analysis, control configuration, evidence packs, policy drafts and tooling, along with the roles of each party. Confirm that the readiness work is kept separate from the validated assessment, because personnel who helped implement or operate the controls in the prior 12 months cannot work on the validated assessment. The partner should not issue or sign any HITRUST report, which only an authorized External Assessor and HITRUST can do. Ask for the assumptions, exclusions and change-order process in the same document, so the budget can be checked against the scope before any work begins.
How DeployOpen scopes HITRUST readiness and evidence
DeployOpen prepares the systems, controls and evidence that sit underneath a HITRUST assessment, so the cost of readiness stays visible and tied to a written scope. We plan and build the self-hosted open-source platforms inside your own infrastructure, while the independent External Assessor performs the validated assessment and HITRUST issues the result.
How we scope
- We agree a written, fixed scope that names the platforms, environments and requirement areas covered before any work starts.
- We map which controls sit in your own environment and which might be inherited from a provider, so you can see what you must build.
- We separate readiness work from the validated assessment, since staff who implemented controls cannot also perform the assessment.
How we build
- We plan and implement the self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
- We harden, configure and integrate the tooling that generates logs, access records, backups and change history used as assessment evidence.
- We test the controls we build, including application and infrastructure security testing, and record the results for the assessor.
How we hand over
- We document the control implementation, owners and evidence locations so an External Assessor can trace each requirement to a source.
- We deliver a readiness package that shows gaps, remediation status and the evidence still needed before fieldwork begins.
- We hand over administration, runbooks and training so your team can maintain the evidence trail between assessments.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after the initial engagement ends.
- A retainer can keep evidence current for an interim assessment or a rapid recertification, which you should confirm against your certification level.
- We do not issue reports or certificates. Ask your External Assessor and HITRUST to confirm what the validated result requires from your environment.
