Is the HITRUST CSF free to download and use?
Your customer questionnaire or contract clause asks for HITRUST, and the first question is whether you can simply download the framework. The answer is that the free HITRUST CSF download is licensed at no fee for internal purposes only, to qualified organizations and individuals, and it is a partial version that does not contain all requirements. Reading it does not make you certified, and it does not give you the full control set that a validated assessment tests. Whether you qualify depends on your relationship to health or personal information and the role you play, not on how small or large your project is. The license names organizations and individuals that use or disclose health or personal information as qualified users. The CSF License Agreement excludes IT security service providers, product providers, consultants and vendors from the free download, so a firm that sells security work to clients generally cannot use it on that basis. Parties with a MyCSF subscription, an Authorized External Assessor agreement or a CSF Readiness License are covered under other terms. Confirm your category against the current HITRUST CSF License Agreement before you download anything. Even when the framework text is free, a validated assessment is not. Assessments are created, scoped and submitted in MyCSF under a paid subscription, and only an Authorized HITRUST External Assessor can perform the validated work that HITRUST quality-checks and issues. Plan budget for the platform, the assessor and any readiness work, and ask each vendor for those costs in writing.
Why consultants and vendors cannot use the free download
The free CSF download is licensed for internal use by qualified organizations, and the license carves out the people who would otherwise profit from distributing or applying it for others. Each card below covers one excluded group or one rule, followed by the licensed route a consultant or vendor should use instead.
IT security service providers excluded
The license does not extend to organizations that sell IT security services. A firm that runs security monitoring, testing or governance for clients cannot rely on the free download to do that work. Check the license definition of a qualified organization before assuming your firm fits, because the exclusion covers the business activity, not only the size of the firm.
Product providers excluded
Vendors that sell software or hardware products are also barred from the free download. A product company that builds a platform its customers use to meet HITRUST requirements cannot treat the partial download as a design reference for that product. Ask your legal team to confirm how the license applies to your product roadmap and marketing materials.
Consultants excluded
Independent consultants who advise clients on HITRUST readiness are outside the free license, even when they work only with qualified organizations. The reasoning is that advice delivered for a fee to others is a different use from an organization studying its own controls. A consultant who wants to work with the CSF needs a licensed route before the first client engagement.
Vendors and the non-disclosure rule
Licensees may not disclose the CSF to customers, vendors or partners. This rule catches a common habit: sharing a requirement list with a supplier or a customer's security team to explain what is expected. Keep the CSF inside your organization, and describe your controls in your own words when a third party asks.
MyCSF subscription route
A consultant or vendor that needs to work with the CSF on a client's behalf should move that work into a MyCSF subscription held by the organization being assessed. The client is the party with the license relationship, and the platform controls who can see assessment content. Confirm with HITRUST which party must hold the subscription before scoping begins.
Assessor and readiness licenses
Firms that perform validated assessments must sign an Authorized External Assessor agreement. Firms that deliver readiness and advisory work sign a CSF Readiness License, which does not allow them to perform validated assessments. Check the HITRUST directory to confirm which license a firm holds before you sign an engagement letter.
What each HITRUST license adds beyond the free download
This table compares the free CSF download with a MyCSF subscription, an Authorized External Assessor agreement and a CSF Readiness License across who holds each one, what it permits and what it costs. Prices are not published, so use the cost column to know what to request from HITRUST. The main takeaway is that only the assessor route can produce a validated assessment, and the free download cannot support one.
| License | Who holds it | What it permits | Cost and how to confirm |
|---|---|---|---|
| Free CSF download | Qualified organizations and individuals using or disclosing health or personal information, under the CSF License Agreement v11.5 | Internal use of a partial version of the CSF that omits some requirements. No validated assessment, no sharing with customers or vendors | No fee. Confirm eligibility against the license agreement before downloading |
| MyCSF subscription | An organization that is a party to a MyCSF subscription agreement with HITRUST | Access to the full framework in the SaaS platform for tailoring, remediation, validation and reporting, plus report sharing controls in the Report Center | Not published. Request a subscription quote from HITRUST and ask what report credits are included |
| Authorized External Assessor agreement | Assessor firms authorized by HITRUST to perform validated assessments submitted for certification | Full framework use to perform validated assessments that HITRUST quality-checks before issuing reports | Not published. Assessor fees are set by the firm, so request a written scope and fee from the assessor |
| CSF Readiness License | Readiness Licensees authorized by HITRUST for readiness and advisory work | Readiness assessments and advisory services. Does not permit validated assessments | Not published. Confirm the license terms and scope directly with HITRUST before engaging |
| Who can run a validated assessment | Only Authorized External Assessor organizations | Validated assessments, which are the only basis for a HITRUST certification | The free download alone is never sufficient. A validated assessment requires an External Assessor and a MyCSF subscription |
Which license fits your role in a HITRUST project
An organization preparing its own HITRUST certification usually holds a MyCSF subscription, which is the license that ties the CSF to its assessment work. Parties to a MyCSF subscription are among those the CSF License Agreement covers for use of the framework, so the subscription is what lets the team tailor requirements, collect evidence and submit the assessment. The free download does not replace it, because the download is a partial version and is licensed for internal purposes only.
- What it may do: use the CSF internally to plan controls, run readiness work and manage the assessment inside MyCSF.
- What it may not do: disclose the CSF to customers, vendors or partners. A customer who wants the framework text should be directed to HITRUST, not sent a copy.
- Access control: when an authorized user leaves, access must be revoked and copies removed.
- Reports: use the MyCSF Report Center to decide who can see certification reports, rather than sending files informally.
Confirm the subscription terms, seat counts and report credits with HITRUST before the team begins, since these are set by the agreement and the purchase, not by this page.
A consultant who helps a client get ready for a HITRUST assessment is not covered by the free download. The CSF License Agreement excludes consultants and IT security service providers from licensing the free version. A consultant who does this work needs its own qualifying relationship with HITRUST, such as a CSF Readiness License, or must work inside the client's MyCSF subscription under the client's license.
- Readiness Licensees: can use the CSF for readiness assessments and advisory services but cannot perform validated assessments.
- Client-held access: the client's MyCSF subscription, not the consultant's download, is the usual route for working inside the assessment.
- No passing on the text: the consultant may not disclose the CSF to the client's customers, vendors or partners.
- Scope of advice: readiness work prepares evidence and controls but does not produce a validated result.
Before engaging, ask the consultant which HITRUST license it holds, and confirm whether it will use the client's MyCSF account or its own.
An External Assessor is an organization authorized by HITRUST to perform validated assessments that are submitted for certification. Its right to use the CSF comes from its External Assessor agreement, which is one of the qualifying relationships named in the CSF License Agreement. That agreement, not the free download, governs how the assessor works with the CSF and how it handles the framework across its engagements.
- Validated work: only Authorized HITRUST External Assessor organizations may perform validated assessments submitted for certification.
- Quality assurance: HITRUST performs central quality assurance before it issues reports.
- Assessed Entity access: assessments are created and submitted in MyCSF, which the Assessed Entity accesses through its subscription.
- Client disclosure: the assessor must still respect the rule against disclosing the CSF to customers or third parties outside the engagement.
Check the firm against HITRUST's directory of External Assessors and Readiness Licensees before signing, and confirm its agreement covers the assessment type you need.
A vendor that only needs to read a customer's HITRUST report does not need a license to the CSF in order to use that report. The report is the product being shared, and the rules on the framework text do not turn a recipient of a report into a licensee. What matters is that the report reaches the vendor through the channel the customer controls, and that the vendor does not treat the report as a copy of the framework.
- Receiving a report: the customer shares it, usually through the Report Center in MyCSF, which controls who can access reports.
- No framework copies: the vendor should not request or redistribute the CSF text from the customer.
- Internal use: the vendor may use the report internally to assess third-party risk, but should not forward the CSF material to its own customers or partners.
- Reliance: the report's scope, validity and any corrective actions determine what the vendor can rely on.
Confirm with the customer which report and scope it is sharing, and whether the report is restricted to named recipients.
What a MyCSF subscription adds to the license
The free CSF download gives you the framework text, but it does not give you a place to run an assessment. MyCSF is HITRUST's SaaS platform where assessments are created, scoped and submitted, and the Assessed Entity works in it through a paid subscription. Inside the platform, workflows cover tailoring of requirement statements, tracking remediation, validation of evidence and reporting. HITRUST describes inheritance of up to 85% of applicable controls within MyCSF, so the subscription is also where you record which controls come from a cloud provider, vendor or earlier assessment. Confirm with HITRUST which inheritance rules apply to your assessment level before you plan around that figure.
HITRUST's Getting Started checklist treats the subscription as a prerequisite. Before a readiness assessment or a validated assessment, the organization chooses an External Assessor, buys a MyCSF subscription and report credit, and then runs scoping and inheritance planning. Ask whether your subscription covers both readiness and validated work, how many report credits it includes and whether those credits expire. Those answers determine what you pay for a second cycle, so check them against the written scope before you sign.
Access control is the other practical difference. The Report Center lets administrators decide who can see completed reports, which matters when a customer or insurer asks for a copy. Name a responsible administrator, limit report access to people with a documented need and remove users who leave, because the CSF License Agreement also requires you to revoke access when an authorized user departs. Your subscription terms and the agreement together define these duties, so have legal review both before your team starts working in the platform.
How the HITRUST Getting Started checklist sequences licensing
The checklist moves an organization from choosing an External Assessor to a validated assessment in a fixed order, so each license, subscription and scoping decision is made before the work it governs begins. Each step closes with a concrete output that the next step depends on.
Choose an External Assessor first
Select an Authorized HITRUST External Assessor organization before buying anything else. The assessor performs the validated assessment that can lead to certification, so its availability and fit shape the rest of the sequence. Only an Authorized External Assessor can perform validated assessments submitted for certification, so confirm the firm's status in HITRUST's directory before signing. The output is a signed engagement with a named firm, which tells you which platform workflows and report credits to plan for.
Buy a MyCSF subscription and report credit
Once the assessor is chosen, the organization or its assessor sets up a MyCSF subscription, which is the platform where assessments are created, scoped and submitted. Assessed Entities access MyCSF through this subscription, and report credits are purchased alongside it. Ask the vendor which subscription tier and how many report credits your assessment level requires, and confirm whether the assessor needs its own access. The output is an active subscription with the assessment record created in the platform.
Run the readiness assessment with scoping
Run a readiness assessment to find gaps before the validated assessment begins. In this step the team scopes systems, facilities and business units in MyCSF, selects the applicable requirement statements and plans inheritance, meaning which controls come from cloud providers, vendors or earlier assessments and which remain the organization's own. A readiness assessment can be carried out by an External Assessor or a Readiness Licensee, who may not perform the validated assessment. The output is a documented scope, an inheritance plan and a gap list that sets the remediation work.
Secure a QA date
Reserve a quality assurance date with HITRUST before the validated fieldwork is due to finish. HITRUST performs central quality assurance on submitted assessments before it issues reports, so the QA slot is a dependency in the schedule, not a formality at the end. Confirm current QA reservation terms with HITRUST and your assessor, since this page gives no QA timing beyond what HITRUST publishes. The output is a confirmed QA date recorded against your assessment, which anchors the remediation deadline.
Remediate gaps before validated fieldwork
Close the gaps identified in the readiness assessment and gather the evidence the External Assessor will test. This is the organization's own work: it owns its controls, changes its systems, and collects and retains evidence, while an implementation partner may prepare systems and documentation if it is engaged. The assessor's validated fieldwork window is at most 90 days for e1, i1 and r2. The output is a scoped, evidenced control set that the assessor can test without open gaps, and a signal to start the validated assessment.
What the partial download leaves out
The free download is a partial version of the CSF, and that gap decides whether it can support a certification. The cards below cover what is missing, what the missing parts do in a validated assessment, and what to check before you plan your own work around the free copy.
Missing requirement statements
The free download does not contain every requirement statement, so it cannot show you the full set that a certification is scored against. In v11.9, the e1 uses 44 requirement statements and the i1 uses 182. Confirm the exact requirement set for your chosen level in MyCSF before you assume any copy you hold is complete.
No scoring or maturity model
A validated assessment scores each requirement and rolls results up across the 19 assessment domains. The free download gives you the text but not the scoring logic your assessor applies, so a self-run score would have no tie to how a certification is decided. Treat any internal scorecard built from the free copy as informal.
No tailoring or inheritance workflow
Tailoring, control inheritance and remediation tracking run inside MyCSF, not in a document. Without the platform you cannot record which requirements apply to your scope, which controls a cloud provider covers, or which gaps are open. Ask whether your planned level needs tailoring before you decide how to track it.
No route to quality assurance
Validated assessments are submitted in MyCSF and reviewed by HITRUST's central quality assurance before a report is issued. An assessment built outside that platform cannot enter that review. Only an Authorized External Assessor can perform the validated work, and the free copy does not change who may sign off.
Scope limits on who may use it
The free download is licensed for internal use, and the license excludes consultants and vendors. If your work involves a client or a third-party engagement, you may need a MyCSF subscription, an assessor agreement or a readiness license instead. Check your role against the license terms before you start.
Where DeployOpen fits in a licensed HITRUST effort
The organization owns its controls, its license and its certification decision. A licensed use of the CSF stays with the licensee, whether that is a MyCSF subscriber, an Authorized External Assessor or a CSF Readiness Licensee. DeployOpen can help an organization prepare, but it does not take over those rights. It works as an implementation partner: under a written, fixed scope agreed before work starts, DeployOpen can build or harden the self-hosted open-source platforms the organization runs inside its own cloud accounts, data centers or air-gapped networks, then produce the configuration records, logs, policy documents and other evidence that the organization's own controls depend on. Decide early which of those tasks sit in the scope and which stay with internal staff, because the boundary determines what the quote covers.
Only an Authorized HITRUST External Assessor performs the validated assessment, and HITRUST issues the report and certification. The assessor tests the evidence, scores the results and submits them through MyCSF, and HITRUST then runs its central quality assurance before any certification is issued. DeployOpen does not hold an assessor or readiness role, so it cannot score a validated assessment, sign a report or issue a certificate, and it should not be described as doing so. Before signing, ask any firm that claims HITRUST involvement to show its status in HITRUST's Find an External Assessor directory, and confirm in writing that DeployOpen's work is limited to preparation and that the assessor you engage is independent of the team that built the evidence.
HITRUST license questions buyers ask
Can we share the free HITRUST CSF with our vendors?
No. The free download is licensed for internal purposes only, and the CSF License Agreement prohibits licensees from disclosing the CSF to customers, vendors or partners. A vendor that needs the framework should obtain its own license through the route that fits its role, such as a MyCSF subscription, an Authorized External Assessor engagement or a CSF Readiness License. Confirm the exact terms in the current agreement with HITRUST before sharing any material outside your organization, because the restriction applies even when the recipient is helping you comply.
Can a consultant use the free CSF under our account?
Generally no. The CSF License Agreement excludes IT security service providers, product providers, consultants and vendors from licensing the free download. A consultant who needs to work with the framework should hold its own qualifying license, such as a CSF Readiness License for readiness and advisory work or an Authorized External Assessor agreement for validated assessments. Ask any firm you hire to show which license covers its work, and confirm with HITRUST how your engagement terms interact with the agreement before work starts.
What happens when an authorized user leaves our organization?
You must revoke that person's access and remove any copies of the CSF they hold. The CSF License Agreement requires licensees to take these steps when an authorized user leaves, so the practical work is an access review tied to your joiner, mover and leaver process. Record the revocation, since an assessor or HITRUST may ask how access to licensed material is controlled. Confirm the exact wording and any notice obligations in the current agreement with HITRUST.
Do we need a MyCSF subscription to be certified?
Assessments are created, scoped and submitted in MyCSF, which the Assessed Entity accesses through a subscription, so a validated assessment generally runs through a MyCSF subscription. The subscription is a platform cost that recurs with each assessment cycle and is separate from the assessor's fees. HITRUST's Getting Started checklist also lists a subscription and report credit among the early steps. Ask HITRUST or your External Assessor to confirm which subscription tier and report credits your assessment level and scope require.
What does a readiness license allow us to do?
A Readiness Licensee may use the CSF for readiness assessments and advisory services, such as scoping, gap identification and remediation planning. It does not perform validated assessments, so it cannot produce the scored results that HITRUST certification requires. Readiness work is useful before a validated assessment, but the license does not replace the External Assessor who scores the validated work. Check the firm's current license status on HITRUST's directory before you sign.
Can we run a validated assessment ourselves?
No. Only Authorized HITRUST External Assessor organizations may perform the validated assessments submitted for certification, and HITRUST performs central quality assurance before it issues reports. Your internal team can prepare evidence, run a self-assessment for internal learning and manage the MyCSF workflow, but the scored validated assessment must come from an authorized firm. Ask any assessor to show its current authorization and to explain which parts of the work your staff will carry out.
What should we ask a partner before signing?
Start with the license question, then the scope. Ask the partner which HITRUST license covers each activity it will perform, whether it is an Authorized External Assessor or a Readiness Licensee, and how it will handle the restriction on sharing the CSF. Next, ask for a written scope listing deliverables, responsibilities, who holds the MyCSF subscription and what is included in the quote. Confirm which costs are one-time and which recur, such as subscriptions, report credits and renewal work. DeployOpen prepares systems, controls and evidence for assessments but does not issue reports or certifications, so ask any firm to confirm which party issues the outcome.
How DeployOpen works on this
Whether the HITRUST CSF download fits your situation depends on who you are and what you plan to do with the framework. DeployOpen works on the implementation side of HITRUST preparation: we prepare the systems, controls and evidence your organization owns, and we never issue reports or certifications.
How we scope
- We confirm which license route applies to your organization before any engagement starts, including whether you need a MyCSF subscription or a readiness license.
- We record in writing which systems, teams and data flows fall inside the HITRUST preparation scope and which sit with an External Assessor.
- Engagements are fixed-scope, so deliverables, timelines and responsibilities are agreed in writing before work begins.
How we build
- We set up self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, under your administrators.
- We configure access control, logging and change records so that evidence for HITRUST requirements is generated as systems run.
- We test the configured controls against the requirements you have scoped, and we document gaps for your team to remediate.
How we hand over
- We deliver written documentation of configurations, control ownership and evidence locations that your assessor can review directly.
- We train your staff to operate the platforms and to pull evidence, so the knowledge stays with your organization after handover.
- We confirm with you which license terms apply to each person who receives CSF material, so internal sharing stays within the license.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, agreed in a separate written scope.
- We can help you update controls when the CSF version changes, once your organization has confirmed the version it is assessing against.
- Your independent assessor remains responsible for the validated assessment, report and any certification, and we do not act in that role.
