How long HITRUST certification takes

How long HITRUST certification takes for your level and readiness

HITRUST cites an average of about 30 days for e1 certification and 6 to 12 months for most i1 certifications, depending on readiness. Those figures describe how long the work typically takes, but a contract deadline is set against calendar dates, so the schedule has to be built backward from the date a customer needs the result. The same level can take very different times because the schedule is set by fixed rules rather than by effort alone: a 90-day incubation period before controls can be tested as implemented, a fieldwork window of at most 90 days, a QA reservation in MyCSF that HITRUST books in one-week blocks, and a 30-day draft review before the report is final. Before you commit to a date, confirm with your External Assessor which QA block is available and when it would fall relative to your deadline.

The organization owns its controls and makes the decisions on scope and evidence. DeployOpen, where engaged, prepares systems, configuration, documentation and evidence so that controls have been operating long enough to be tested. Only an authorized External Assessor performs the validated assessment, and only HITRUST issues the report and certification after its quality assurance review. Ask any implementation partner to show, in writing, which incubation dates it is planning against and which dates depend on the assessor and on HITRUST.

Start the incubation clock early, because it cannot be shortened. Controls must run in their current state for at least 90 consecutive days, and policies and procedures need 60 days, with no partial credit for a shorter period. Any control you add or remediate during readiness restarts that count. A useful check for your team is to list every control the customer's contract cares about, record the date each one went live in production, and compare those dates against the planned fieldwork start. Controls that are still being changed in the weeks before fieldwork are the most common reason a timeline slips.

The phases between kickoff and certification, and what each one produces

The sequence runs from scoping in MyCSF through a fixed period of operating evidence, a 90-day External Assessor fieldwork window, HITRUST quality assurance and a 30-day draft review, and each phase ends with a specific document or decision.

Scope the assessment in MyCSF
The organization defines the systems, facilities and control environment it wants certified, selects the assessment level and records the scope in MyCSF with its External Assessor. This work is done by the organization, often with its assessor or a readiness advisor, and it sets every later date. The phase is complete when the scope is recorded in the platform and agreed with the assessor. Confirm with your assessor which components count as primary scope before you start the clock on operating evidence.
Run systems in production for 90 days
HITRUST certifies only implemented systems under the entity's control, meaning installed and operating in production with all primary scope components in place. Each in-scope system must have been running for at least 90 days before testing. The period can overlap fieldwork if testing starts after those 90 days have passed. The output is a record showing when each primary component went live, which the assessor will check during testing.
Hold controls steady for 90 consecutive days
Each control must run in its current state for at least 90 consecutive days before it can be tested as implemented. This includes new controls and controls that were remediated during preparation. Policies and procedures need 60 days. HITRUST gives no partial credit for a shorter period, so a control changed late in the cycle restarts its clock. The output is dated operating evidence, such as logs, tickets, review records and approvals, that shows the control ran continuously.
Complete External Assessor fieldwork in 90 days
An Authorized HITRUST External Assessor performs all testing inside a single 90-day fieldwork period. The period ends when the entity signs its management representation letter, which must be dated within two weeks after fieldwork ends. The assessor samples evidence, interviews staff and scores each requirement. The output is the assessor's completed working set and the signed management representation letter, which together form the validated assessment submitted to HITRUST.
Reserve a QA block in MyCSF
Every validated assessment needs a quality assurance reservation in MyCSF. QA blocks are one-week periods, and reservations can be booked up to one year ahead. Plan the reservation with your assessor before fieldwork ends so the submission does not wait for an open block. HITRUST typically contacts the entity 7 to 10 business days after the block is confirmed. The output is a confirmed QA slot and a submitted validated assessment.
Wait for HITRUST quality assurance
HITRUST performs central quality assurance on the submitted assessment before it issues any report. HITRUST commits to a QA service level of 30 days for e1 assessments and 45 days for i1 assessments. If HITRUST misses that level, the next report credit is complimentary. The organization's role is to answer any HITRUST questions promptly. The output is the QA result that moves the assessment to draft report stage.
Review the draft report within 30 days
After QA, the entity has 30 days to review the draft report. At this stage scope, factors and scores cannot be changed, and no new evidence is accepted, so factual accuracy checks must happen early in the review. A draft that is not acted on within 30 days is approved automatically. The output is an approved draft that HITRUST finalizes into the certification report and letter, which an organization should read in full before it approves.

Why the 90-day incubation rule often sets the start date

The 90-day incubation rule often decides the earliest date a HITRUST validated assessment can start, because a control cannot be tested as implemented until it has run in its current state for at least 90 consecutive days. The rule applies to new controls and to controls that were remediated during readiness, and HITRUST allows no partial credit for a shorter run. Policies and procedures follow a shorter clock of 60 days, so they usually become testable sooner than technical controls. Organizations should not assume that the readiness timeline and the fieldwork timeline are the same thing. A control that is fixed in month five of readiness does not inherit the time that passed before the fix. Its clock starts on the date the fixed version went live.

This makes the slowest control in scope the practical gatekeeper. If one access review process, one logging configuration or one vendor management procedure was changed late, the whole assessment can wait until that control has accumulated its full period, even when every other control is ready. Teams should build a control-by-control tracker that records the date each control entered its current state, the date it reaches 60 or 90 days, and the owner responsible for it. Changes made during readiness should be logged with the same discipline, because a later edit to a control can restart its clock.

The organization owns its controls and the evidence that proves their operating history, so it is responsible for knowing these dates. Ask your External Assessor to confirm, in writing, which controls they will test as implemented, the earliest date each can be tested, and how the 90-day period interacts with the fieldwork window and the management representation letter. Treat that confirmation as the source of truth for the project plan. Readiness support from an implementation partner can help you build the tracker and gather the records, but the partner does not decide when a control is ready to test.

What lengthens or shortens a HITRUST timeline

The calendar for a HITRUST certification is set less by the assessment itself than by what happens before fieldwork starts. Several drivers sit with the organization, some with its implementation partner, and some with the External Assessor and HITRUST. Knowing who owns each one lets a buyer plan the path with realistic dates.

Readiness and evidence maturity

An organization that already runs its controls and keeps evidence in a repeatable form spends less time preparing for fieldwork than one that must build both at once. Gaps found late tend to restart the clock on the affected controls. Before committing to a date, have the partner run a readiness assessment against the requirement statements in scope and list which evidence exists, where it lives and who owns it. Ownership: the organization owns its evidence, the partner helps structure it, and the assessor tests it.

Primary scope components and systems

Every system and primary scope component that HITRUST will certify must be installed and operating in production for at least 90 days before it counts as implemented. Adding a component late in preparation can push the entire scope back, even when the other systems are ready. Fix the scope in MyCSF early and decide which systems are truly in scope rather than including them by default. Ownership: the organization defines scope, and the partner confirms the boundary matches the environment.

New or remediated controls

A control that is new or was remediated must run in its current state for at least 90 consecutive days before it can be tested as implemented. Policies and procedures need 60 days. There is no partial credit for a shorter period, so a control fixed in the final weeks of preparation may not be testable in the planned window. Build a dated list of every change and work backward from the earliest date each one can be tested. Ownership: the organization makes and dates the changes, and the assessor confirms the operating period.

Inherited controls from cloud and vendor reports

Controls inherited from a cloud provider or vendor depend on that party's own assessment results and on how the shared responsibility matrix is documented. If the provider's report is current and covers the controls you rely on, your fieldwork has less to test. If it has gaps, or the carve-out is unclear, the assessor may need additional evidence late in the process. Confirm the inheritance position with each provider before fieldwork begins. Ownership: the organization decides what it inherits, the provider supplies current evidence, and the assessor accepts or rejects the reliance.

QA block availability

Every validated assessment needs a QA reservation in MyCSF. QA blocks are one-week periods, and reservations can be booked up to one year ahead. Booking early secures a slot, but booking before evidence is ready risks a block that arrives before the work is finished. After the block, HITRUST typically contacts the entity 7 to 10 business days later. Ask your External Assessor which block fits the fieldwork end date. Ownership: the organization books the block, the assessor signals readiness, and HITRUST schedules quality assurance.

Draft report review turnaround

After quality assurance, the organization has 30 days to review the draft report. Scope, factors and scores cannot be changed at that stage, and no new evidence is accepted. Drafts not acted on within 30 days are approved automatically. Assign a named reviewer, agree on factual corrections in advance with the assessor, and keep the relevant evidence ready so the review does not stall. Ownership: the organization reviews and responds, and the assessor and HITRUST resolve factual points.

How the timeline differs for e1, i1 and r2

The e1 is the shortest path to a HITRUST certification. HITRUST cites an average of about 30 days for e1 certification, depending on readiness. That average covers the validated work that follows preparation, not the months spent getting systems and controls ready. The v11.9.0 e1 baseline contains 44 requirement statements, which keeps the assessor's testing set small compared with the other levels.

Requirement count: The e1 baseline in v11.9.0 has 44 requirement statements.
Average duration: HITRUST cites about 30 days for e1 certification, which is an average and not a guarantee.
Incubation first: Controls must run in their current state for at least 90 consecutive days before they can be tested as implemented, so a fast assessment still depends on a settled environment.
Fieldwork and QA: Testing falls within a fieldwork window of at most 90 days, and QA targets 30 days for e1 validated assessments.
Validity: An e1 certification lasts one year.

Confirm with your External Assessor whether your environment is already past the incubation period for every in-scope control before booking a QA reservation.

How QA service levels and draft review affect the final date

The final date of a HITRUST validated assessment depends on two clocks that run after your External Assessor finishes fieldwork. The first is HITRUST quality assurance. HITRUST commits to a quality assurance service level of 30 days for e1 validated assessments and 45 days for i1 validated assessments, and states that the next report credit is complimentary if it misses that level. That credit is a consolation, not a schedule. Plan the certification date from the QA service level, add the time you need for the draft review, and do not assume the report will arrive on the first day the service level allows. Ask your assessor which QA block your reservation sits in, because the block you hold in MyCSF sets when the clock starts for HITRUST's team.

The second clock is the draft review. After QA, the organization has 30 days to review draft reports. This is the last point at which you can respond, and the rules at this stage are strict. Scope, factors and scores cannot be changed, no new evidence is accepted, and any draft not acted on within 30 days is approved automatically. A factual error can still be raised in that window, but a control you believe was scored too low cannot be reopened with fresh documents. Before fieldwork closes, name the people who will read the drafts, including the compliance lead, the control owners for the highest-risk domains and a signatory for the management representation letter, and confirm their availability for the full 30 days. Staff the review as a planned task, not as something to schedule once the draft arrives.

Treat the draft review as a deadline you control. Confirm with your External Assessor, before fieldwork starts, what they expect you to check, how they will deliver drafts and who on your side receives them. If your team is planning a customer deadline, a renewal or a contract milestone, subtract the QA service level and the 30-day review from that date and then add a margin for the chance that the report comes late. Ask HITRUST and your assessor to confirm current QA timing for your specific block in MyCSF, since reservations can be booked well ahead and the expected turnaround is a matter of record rather than a fixed promise.

Schedule mistakes that push certification back

Most HITRUST delays come from scheduling decisions made weeks or months before fieldwork starts. The four mistakes below share one root cause: the clock for incubation, fieldwork and draft review runs on fixed rules, and a late change restarts or consumes part of it.

Adding a system after incubation starts

Each system in scope must be installed and operating in production with all primary scope components for at least 90 days before it can be certified. A system added after incubation has begun starts its own clock, which can push the fieldwork window past the point you planned. Before you start incubation, confirm the final list of systems, components and locations with your External Assessor and freeze the MyCSF scope.

Expecting late fixes to count at once

A new or remediated control must run in its current state for at least 90 consecutive days before it can be tested as implemented, and policies and procedures need 60 days. There is no partial credit for a shorter period. If you fix a gap two months before fieldwork, that control may not qualify in time, so check every open remediation against its start date before you book anything.

Booking QA before fieldwork is ready

Every validated assessment needs a QA reservation in MyCSF. Blocks are one-week periods and can be booked up to one year ahead, so a block that arrives before your evidence is complete can force a rushed submission or a missed slot. Book only when your External Assessor confirms that testing and documentation are finished, and ask them to confirm the block date against your fieldwork end date.

Missing the 30-day draft review

After QA you have 30 days to review the draft report. Scope, factors and scores cannot change at this stage, and no new evidence is accepted. Drafts you do not act on within that period are approved automatically, so a draft with a factual error can go forward unchanged. Assign a named owner for the draft, put the 30-day deadline in your project plan and review the draft against your evidence log as soon as it arrives.

Who owns each part of the schedule

The organization owns the certification and every control it claims. It decides the scope in MyCSF, makes the risk and N/A decisions, runs the controls day to day, and signs the management representation letter that closes fieldwork. Those obligations cannot be handed to a partner, because the assessor tests what the organization actually does, and the organization is the party named in any resulting report.

Scope and factor decisions: Choosing which systems, facilities and business units fall inside the assessment, and which HITRUST factors apply, sets the work for every other party.
Control operation: Controls must run in their current state for at least 90 consecutive days before they can be tested as implemented, and policies and procedures need 60 days. The clock runs on the organization's operations, not on the consultant's calendar.
Evidence ownership: Logs, tickets, approvals and training records must come from the organization's own systems and staff.
Management representation: The organization signs the representation letter, which must be dated within two weeks after fieldwork ends.
QA reservation: The organization books the QA block in MyCSF and answers the assessor's follow-up questions.

Ask your internal owners to confirm which 90-day and 60-day periods already have clean evidence before you commit to a date.

Questions buyers ask about HITRUST timelines

How long does an e1 HITRUST certification take on average?

HITRUST cites an average of about 30 days for e1 certification, but that describes a typical path, not a guaranteed schedule. The e1 has 44 requirement statements in v11.9, so the work is mostly confirming that a short set of controls is in place and operating. Your calendar still has to include the 90-day rules for implemented systems and controls, a QA reservation in MyCSF, and HITRUST's quality assurance service level of 30 days for e1 validated assessments. Ask your External Assessor to walk through each date from scoping to certification, and confirm which controls already have enough run time to be tested.

Why does i1 certification take anywhere from 6 to 12 months?

HITRUST says most organizations complete i1 certification within 6 to 12 months, depending on readiness. The i1 carries 182 requirement statements in v11.9, so the spread mostly reflects how much of that baseline is already implemented, documented and running in production. An organization with mature controls spends its time on scoping and evidence. One building controls from scratch must wait out the run-time periods: implemented systems need at least 90 days in production with all primary scope components, controls need 90 consecutive days, and policies and procedures need 60 days. Ask for a gap list that gives the earliest date each control can be tested.

Can the 90-day HITRUST rules be shortened to speed up certification?

The HITRUST Assessment Handbook gives no shortcut, and it allows no partial credit for a shorter period. Controls must run in their current state for at least 90 consecutive days before they can be tested as implemented, and that includes new or remediated controls. Policies and procedures need 60 days. All External Assessor testing must fall within a 90-day fieldwork period that ends when you sign the management representation letter, which must be dated within two weeks after fieldwork ends. The practical lever is sequencing: start run-time clocks early, avoid changing controls during the window, and book your QA reservation with these periods in mind. Confirm how the rules apply to your scope with your assessor before you commit to a date.

What happens if a control fails partway through the assessment?

A failed or remediated control starts a new clock. The Handbook requires a new or remediated control to run in its current state for at least 90 consecutive days before it can be tested as implemented, and a shorter run earns no partial credit. Ask your assessor, in writing, how a finding affects your fieldwork dates, evidence and scoring, and keep dated records of each fix. The draft review stage is narrow: after QA, scope, factors and scores cannot change, and no new evidence is accepted. Drafts not acted on within 30 days are approved automatically. The practical window to fix a gap therefore closes before draft review begins.

Does the HITRUST timeline include the r2 interim assessment?

No. The initial r2 timeline covers the first validated assessment, and the interim assessment starts a later cycle. An r2 certification lasts two years, and the interim assessment is due in the 90 days before the first anniversary. The interim therefore has its own calendar, including a 90-day fieldwork window, a QA reservation in MyCSF and the 30-day draft review period. Changes to systems, controls and evidence made since the initial assessment may need to be tested again, so the run-time rules apply to those changes. Plan the interim well before its window opens, and confirm its scope with your External Assessor.

How much work does our internal team need to do for HITRUST?

Your team owns the controls, so most of the work stays in-house even when an outside party helps prepare systems and evidence. No single effort figure applies to every organization, so ask for an estimate in writing. The work falls into a few groups: confirming scope and system boundaries in MyCSF, writing policies and procedures, operating controls for the required periods, producing the evidence samples your assessor requests, and answering questions during fieldwork and draft review. Continuous operation of controls usually places the heaviest load on staff across the whole window. An implementation partner such as DeployOpen can prepare systems, controls and evidence, but only an authorized External Assessor performs the validated assessment. Ask your assessor and any partner to list each internal role and its expected hours before you sign.

How DeployOpen prepares systems and evidence to meet the schedule

DeployOpen's part in the timeline is to get the systems in scope running early enough that their controls can show the operating history HITRUST requires. A 90-day operating period is the constraint that sets the schedule. HITRUST only certifies systems that are installed and running in production with all primary scope components for at least 90 days, and each control must run in its current state for 90 consecutive days before it can be tested as implemented. Policies and procedures need 60 days. Because a shorter period earns no partial credit, the first planning decision is which open-source platforms, identity components, logging pipelines and backup services fall inside the boundary, and when each one goes live.

In a fixed-scope engagement, DeployOpen scopes those systems with you, then implements, hardens and integrates the open-source platforms inside your own cloud accounts, data centers or air-gapped network. The work includes configuring access controls and logging, setting up evidence collection so each control leaves dated records from the first day it operates, and running backup and upgrade routines that you can show an External Assessor. Before fieldwork begins, DeployOpen hands over written documentation of the configurations, system boundary, evidence locations and control owners. The deliverables, dates and responsibilities are agreed in writing before work starts. Ask for a dated plan that counts the 90-day periods backward from your target fieldwork window, and confirm which dates depend on your own change approvals.

DeployOpen does not issue HITRUST reports, scores or certifications. Only an authorized HITRUST External Assessor performs the validated assessment, and HITRUST performs quality assurance before it issues a report. Your organization owns its controls and the management representation letter, which must be dated within two weeks after fieldwork ends. No outcome is guaranteed: a schedule can slip if evidence gaps appear, a control changes during its operating period, or the QA queue delays the report. Confirm your QA reservation and assessor timing directly with HITRUST and your assessor, and treat DeployOpen's plan as a way to remove avoidable delay, not as a promise of a certification date.

How long HITRUST certification takes