Choosing a HITRUST external assessor: what to check

Which firm can perform a HITRUST external assessment?

Only organizations listed as Authorized HITRUST External Assessors may perform the validated assessments submitted for certification, and HITRUST performs central quality assurance before it issues any report. If a customer or contract requires HITRUST, the firm you pick for the validated assessment has to hold that status, and it has to be confirmed in HITRUST's directory rather than taken from a proposal. Other firms can still help you prepare, but they cannot sign off the result. The right choice depends on the role you need filled: a validated assessment, readiness work to find gaps before the assessment, or implementation help to build and document the controls the assessor will test. Those roles are separate, and a single firm may not be able to cover all three.

Your organization owns its controls, policies and risk decisions. An implementation partner such as DeployOpen can plan, configure, harden and document self-hosted open-source platforms inside your environment, and prepare the systems, controls and evidence an assessor will review. DeployOpen does not issue HITRUST reports, letters or certifications, and it does not act as an External Assessor. Before you engage any firm, check three things: its directory status, whether its staffing meets HITRUST's rules for who may work on a validated assessment, and whether its independence arrangements allow it to test controls it helped build. HITRUST does not recommend specific firms, so the due diligence falls to you. Ask the firm in writing who the engagement executive, fieldwork lead and QA reviewer will be, and confirm each holds the CCSFP credential.

External Assessor, Readiness Licensee or consultant: which role fits

This table compares the three roles an organization can bring into HITRUST work: an Authorized External Assessor, a Readiness Licensee and an unlicensed consultant or implementation partner. Read each row against the document you need, since only the first role can perform the validated assessment that feeds a certification. Confirm any firm's status in the HITRUST directory before you sign.

Question	Authorized External Assessor	Readiness Licensee	Unlicensed consultant or implementation partner
Performs validated assessment for certification	Yes	No	No
Can issue the assessment report submitted to HITRUST	Yes	No	No
Can stand in for the assessor on the validated assessment	Yes	No	No
Uses the CSF for readiness and advisory work	Yes	Yes	Not applicable
Prepares systems, controls and evidence	Yes, but independence rules limit it for the same entity	Yes, within the readiness licence	Yes, typically the main role
Best fit	Final validated assessment before certification	Readiness assessment and gap work using the CSF	Engineering, hardening and evidence preparation
What to confirm in the HITRUST directory	Listed as an External Assessor and filterable by assessor type and industry focus	Listed as a Readiness Licensee, with its readiness scope confirmed	Not a directory question for certification, but confirm it is not used as the assessor
Independence limit for the same engagement	Staff who implemented or operated your controls in the prior 12 months cannot work on the validated assessment	Confirm whether readiness work by the same firm affects the later assessor choice	Cannot be the assessor, and its staff may be barred from the assessor team

Who does what: your team, an implementation partner and the External Assessor

Your organization owns the controls, the scope decisions, the evidence and the due diligence on any assessor firm. These responsibilities stay with you even when an implementation partner prepares materials, because the assessed entity is the party whose environment is tested and whose management attests to its controls. HITRUST does not recommend specific assessor firms and makes the assessed entity responsible for its own due diligence before engaging one.

Control ownership: Named owners run each control, operate it day to day and can explain how it works to an assessor.
Scope decisions: Your team decides which systems, locations and business units are in scope in MyCSF, and documents the reasons for any exclusions.
Evidence accountability: Your team confirms that evidence is accurate, current and tied to the right period before it goes to the assessor.
Assessor due diligence: Check the firm against HITRUST's directory, confirm its CCSFP staffing and ask who will perform the fieldwork.
Engagement terms: Management cannot restrict the nature, scope or extent of testing the assessor decides is required, so agree that boundary in writing before fieldwork begins.

Check that every control has a named owner who can speak to it without an outside party in the room.

Why the firm that built your controls may not be the one that assesses them

If your organization hires an implementation partner to build or run the controls that a HITRUST validated assessment will test, that same partner's staff generally cannot perform the assessment. The HITRUST Assessment Handbook (v1.1) bars assessor staff who implemented or operated the entity's controls in the prior 12 months from working on its validated assessment. The External Assessor must put a separate team and a separate engagement executive on the work. For a buyer, this means the independence question is decided before any fieldwork starts, and it shapes which firms can be hired for which tasks.

In practice, the boundary falls between preparing evidence and testing it. An implementation partner may help configure systems, document procedures, or collect artifacts during readiness work, and the External Assessor then tests those controls independently. If the same firm is both the builder and the assessor, the validated assessment is at risk of being challenged or not accepted. Ask each firm, in writing, which named staff will do what, which controls they touched in the last 12 months, and who will serve as the engagement executive and fieldwork lead. Confirm that the assessor's team is separate, and record the scope of any advisory work so it can be reviewed later.

The Handbook also says management of the assessed entity may not restrict the nature, scope or extent of testing that the assessor decides is required. Your internal team and any partner should understand that the assessor sets the testing approach, not the organization being assessed. Agree in the engagement letter how requests to narrow sampling or evidence requests will be handled, and make sure the internal owner knows the assessor, not the project sponsor, decides what is enough. Confirm these terms with your procurement and legal advisers, since this section explains the HITRUST rules and is not legal advice.

What to verify before you engage an External Assessor firm

HITRUST does not recommend specific assessor firms, so the checks below are yours to run before signing. Each one tests a different question: whether the firm is allowed to do the work, whether its people can do it, and whether it can test your environment without conflicts.

Confirm the directory listing

Check that the firm appears in HITRUST's Find an External Assessor or Readiness Licensee directory. HITRUST states that organizations not listed there are not authorized to perform HITRUST readiness or assessment work, so a firm that is missing from the directory cannot deliver a validated assessment, whatever its credentials elsewhere. Only an External Assessor can perform validated work for certification. Ask for the firm's listing type in writing and confirm it yourself on the directory, because a Readiness Licensee listing does not cover validated fieldwork.

Verify CCSFP and CHQP staffing

External Assessor firms must employ at least 5 CCSFPs and 2 CHQPs at all times, so ask for current headcount and confirm the credentials rather than accepting a count from a sales deck. The engagement executive, fieldwork lead and engagement QA reviewer on your assessment must each hold the CCSFP. Ask the firm to name these people before you sign, and check that they are the staff who will actually work on your engagement.

Check the 50 percent CCSFP hours rule

At least 50% of the engagement hours on a validated assessment must be performed by CCSFPs. Ask the firm how it plans the split between CCSFP and non-CCSFP staff across fieldwork, and whether the proposed hours meet that threshold. A proposal that relies heavily on junior staff without CCSFP oversight may fail the rule, and that exposure lands on your certification timeline and cost.

Test independence from your implementation work

Staff who implemented or operated your controls in the prior 12 months may not work on your validated assessment, and the assessor must use a separate team with a separate engagement executive. If the same firm is also building your controls, ask how it will wall off those people and who signs off the independence decision. Keep the implementation partner and the assessor distinct in your contracts, so each owns its own deliverables.

Use industry focus and AICPA filters

The directory lets you filter by assessor type, industry focus and AICPA membership. Use these filters to shortlist firms with experience in your sector, such as healthcare or financial services, and with the audit background your customers expect. Filters narrow the list only; they do not show quality, so follow up with reference checks and questions about engagements similar in size and scope to yours.

Require named staff and a written scope

Before engagement, get the names of the people who will perform fieldwork, the QA reviewer and the engagement executive, plus a written scope that states the assessment level, the systems covered, the fieldwork window and the deliverables. Because management may not restrict the testing the assessor decides is needed, the scope should record what the firm has agreed to test and how changes will be handled. Treat due diligence as your job: HITRUST leaves the choice and its risks with you.

How to check a firm against HITRUST's directory

This sequence lets a buyer confirm that a proposed firm is listed in HITRUST's directory with the right status, that the named people hold the required credentials, and that the team is independent of the controls it will test. Each step ends with a written record the buyer can keep in its vendor due diligence file.

Open the HITRUST directory and search
Start from HITRUST's Find an External Assessor or Readiness Licensee page and search for the firm by name. Confirm that the entry matches the legal entity you are contracting with, including any parent or affiliate name that appears on the proposal. HITRUST states that organizations not listed in the directory are not authorized to perform HITRUST readiness or assessment work, so a missing listing ends the check. The output is a saved screenshot or printout of the directory entry with the date you checked it.
Filter by assessor type and industry focus
Use the directory filters for assessor type, industry focus and AICPA membership to see how the firm is classified and where it reports its experience. Compare the filter results with what the firm's proposal says about its practice, and note any difference to raise with the firm. The output is a short note recording the classification, the industry focus listed and the AICPA membership status, if shown.
Confirm External Assessor status for validated work
If the engagement ends in a validated assessment submitted for certification, the firm must appear as an External Assessor. A Readiness Licensee is licensed to use the CSF for readiness assessments and advisory work but does not perform validated assessments. Ask the firm in writing which status it holds for this engagement, and confirm the answer against the directory entry. A firm that only holds Readiness Licensee status can still support preparation work, but it cannot issue the validated assessment. The output is written confirmation of the status that applies to this engagement.
Request named engagement personnel in writing
Ask the firm to name the engagement executive, the fieldwork lead and the engagement QA reviewer for the validated assessment. HITRUST requires each of these roles on a validated assessment to hold the CCSFP credential. Ask for each person's full name so you can verify their status. The output is a written roster of the three named individuals tied to the proposal, with the roles each one will hold.
Verify CCSFP status for each named person
Check each named individual's CCSFP status through the credential holder information the firm provides and any verification route HITRUST makes available to buyers. Also ask what share of engagement hours the firm expects CCSFPs to perform, since HITRUST requires at least 50% of validated assessment engagement hours to come from CCSFPs. Ask the firm to confirm that its own staffing meets the HITRUST minimums for CCSFP and CHQP headcount. The output is a dated verification record for each person and a written statement on CCSFP hours.
Check the team for prior control involvement
Ask the firm to confirm in writing that no proposed team member helped implement or operate your controls in the prior 12 months. HITRUST requires a separate assessor team with a separate engagement executive where that condition applies, so ask how the firm separates staff who advised on your remediation or readiness work from the validated assessment team. If the firm has done both readiness and validated work for you, ask it to explain the separation in detail. The output is a signed independence statement from the firm and a named list of team members who were not involved in your control operations.
Record the check in your due diligence file
Place the directory screenshot, the status confirmation, the personnel roster, the CCSFP verification records and the independence statement in your vendor due diligence file, with the date of each check and the name of the person who performed it. HITRUST does not recommend specific assessor firms and states that the assessed entity is responsible for its own due diligence, so this file is the record of that responsibility. Repeat the directory check before the fieldwork window opens, since the file should show the status in force when the work starts. The output is a complete due diligence file ready for internal review or audit.

Mistakes that delay the project or lead to a rework of the engagement

Most delays in choosing a HITRUST assessor trace back to a few decisions made early: who is hired, who is staffing the work, and what is in the contract. Each card below describes a pitfall, why it matters for a validated assessment, and what to check before signing.

Hiring a Readiness Licensee for validation

Readiness Licensees are licensed to use the CSF for readiness assessments and advisory services, but they do not perform validated assessments. A firm that helps you prepare cannot issue the validated result your customer expects. Before signing, confirm in writing that the firm is an Authorized External Assessor listed in HITRUST's directory for the validated assessment you need, and ask who will be the engagement executive on that work.

Using a firm that built your controls

Assessor staff who implemented or operated your controls in the prior 12 months may not work on your validated assessment. A firm that designed or ran those controls may therefore be unable to staff the fieldwork once the assessment starts, which forces a late change of team. Ask each proposed firm to confirm whether it has done implementation or operation work for you in that period, and whether it can field a separate team with a separate engagement executive.

Accepting unverified CCSFP staffing

Assessor firms must keep at least 5 CCSFPs and 2 CHQPs on staff at all times. The engagement executive, fieldwork lead and engagement QA reviewer on a validated assessment must hold the CCSFP, and at least half of validated engagement hours must be performed by CCSFPs. Ask for named individuals, confirm their CCSFP status, and write the staffing commitments into the proposal so a substitution does not go unnoticed.

Letting management limit testing

The assessed entity's management may not restrict the nature, scope or extent of testing that the assessor determines is required. Contracts that cap sample sizes, exclude systems or dictate which evidence the assessor may see can force rework when HITRUST quality assurance finds gaps. Write into the contract that the assessor sets the testing approach, and agree on how disagreements about scope are escalated before fieldwork begins.

Treating directory listing as endorsement

HITRUST does not recommend specific assessor firms. A listing in the directory confirms authorization, not quality, fit or price, and the assessed entity remains responsible for its own due diligence. Check references, ask about similar industries and assessment levels, review the proposed team's experience, and confirm how the firm handles HITRUST quality assurance and the fieldwork window before choosing it.

Signing before scope is written

Engagements that start on verbal agreement often reopen scope, deliverables and timing after evidence collection has begun. Before signing, agree in writing on the assessment level, the systems and business units in scope, the deliverables, the fieldwork dates within the 90-day fieldwork window, and who on your side owns each evidence request. A written scope gives both parties a fixed baseline for changes.

Questions buyers ask before hiring an external assessor

Can a HITRUST consultant perform the validated assessment for us?

No, not unless that firm is an Authorized HITRUST External Assessor organization. External Assessors are the only entities authorized to perform validated assessments submitted for certification. A consultant that is not an External Assessor can help you prepare, map controls and gather evidence, but it cannot score the validated assessment or submit it for certification. Before you sign, ask the firm for its directory listing and confirm that the people named on your engagement hold the right credentials. Your organization owns its controls, the assessor tests them, and HITRUST performs quality assurance before any certification is issued.

Can a Readiness Licensee issue our HITRUST result?

No. Readiness Licensees are licensed by HITRUST to use the CSF for readiness assessments and advisory services, but they do not perform validated assessments. A readiness report shows where your controls stand against the requirements, which is useful for planning, but it is not a certification and should not be presented to a customer as one. If a customer or contract asks for a HITRUST certification, the validated assessment must be performed by an External Assessor, and the result is issued by HITRUST after its quality assurance review. Confirm the firm's role in writing before scoping begins so that readiness work and validated work are not confused.

Can the firm that helped us prepare also perform our assessment?

Only if the independence rules allow it. HITRUST prohibits assessor staff who implemented or operated your controls in the prior 12 months from working on your validated assessment. The assessor must use a separate team with a separate engagement executive. In practice, a firm that configured your security tooling, ran your controls or remediated gaps on your behalf will usually be ineligible to assess those same controls. Ask the firm to describe, in writing, which of its people worked on your environment and how it will separate teams. Preparation advice from a firm that did not operate your controls is a cleaner arrangement and easier to defend to a customer.

How do we check whether an assessor firm is authorized?

Check the firm against HITRUST's official directory before you engage it. HITRUST states that organizations not listed in the directory are not authorized to perform HITRUST readiness or assessment work. You can filter the directory by assessor type, industry focus and AICPA membership, which helps you shortlist firms that match your sector and assessment level. Save the listing, note the date you checked it, and recheck it before contract signature. HITRUST does not recommend specific firms, so the due diligence is your responsibility. Ask prospective firms how many of their staff hold the CCSFP credential, who would serve as engagement executive and who would act as engagement QA reviewer.

What does the assessor need from our team during fieldwork?

The assessor needs access, evidence, named owners and fast answers. Fieldwork for e1, i1 and r2 validated assessments runs within a window of at most 90 days, so delays from your side compress the time available for testing. Assign a named owner for each control area, give the assessor read access to the systems and documentation it needs, and agree how evidence requests will be logged and answered. Management cannot restrict the nature, scope or extent of testing the assessor decides is required, so expect requests for samples and system walkthroughs. Your team should also plan for the time those people spend away from their normal work during fieldwork.

Does HITRUST recommend a specific assessor firm?

No. HITRUST does not recommend specific External Assessor firms. It publishes a directory of authorized firms and Readiness Licensees, and it states that the assessed organization is responsible for its own due diligence before engaging one. That means you should compare firms on authorization status, relevant sector experience, staffing, independence and how they will communicate during the engagement. Ask for references from organizations of similar size and scope, and request a written scope and deliverables list before you commit. A firm that claims HITRUST endorsement or a special relationship with HITRUST should be verified directly against the directory.

Who issues the HITRUST certification after the assessment?

HITRUST issues the certification, not the assessor. The External Assessor scores the validated assessment and submits it, then HITRUST performs central quality assurance before it issues the report and certification. This separation is why a certification carries weight with customers: the assessor's work is checked by a central body before the result is released. An assessor cannot promise a particular outcome or issue a certificate on HITRUST's behalf. Ask any firm to explain its quality assurance handoff, and expect the final certification timing to depend on HITRUST's review as well as the fieldwork schedule.

How DeployOpen works on this

DeployOpen prepares the systems, controls and evidence that an assessor will test, and it does not perform or issue the assessment itself. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support is available as a retainer.

How we scope

We confirm which assessment level your customer or contract asks for before any system work begins.
The written scope lists the systems, environments and CSF domains we will prepare for your chosen external assessor.
We identify which controls your cloud provider or vendors cover, so responsibilities are documented before fieldwork.

How we build

We configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
We implement and document the technical controls in scope, including access, logging, backup and configuration baselines.
We test the controls in the agreed scope so gaps are found and documented before an independent assessor arrives.

How we hand over

You receive documentation of configurations, control ownership and the evidence each control produces.
Evidence packages are organized by domain so your team and the external assessor can trace each control to its records.
Your team keeps the systems and evidence, and the assessor reaches its own conclusions and issues any report or certificate.

How we support

Ongoing support, upgrades and continuous testing are available under a retainer after the written scope is delivered.
We can help your team keep evidence current between assessment cycles, including after platform upgrades.
Confirm with us during scoping which support terms, response expectations and handover items apply to your engagement.

Choosing a HITRUST external assessor