How do you get a HITRUST alternate control approved?
If you cannot implement a HITRUST requirement statement as written and your validated assessment is approaching, you must submit compensating controls with a risk analysis to HITRUST at least 30 days before validated fieldwork. An Alternate Controls Committee of HITRUST leadership and subject matter experts then decides whether to accept them. Start this work early, because the submission date, not the fieldwork date you hoped for, sets your real deadline. The organization owns both the control decision and the risk it carries. Your team chooses the alternate control, accepts the residual risk and signs the risk analysis. An implementation partner can help you design the control, write the risk analysis and assemble the supporting evidence, but that partner does not decide whether HITRUST accepts it. Only the independent External Assessor performing your validated assessment, together with HITRUST quality assurance, determines how the result is scored and reported. Confirm this division of responsibility in your engagement letter before any design work begins.
Three factors drive whether the committee is likely to accept a proposal. The first is risk similarity: the alternate control must address a similar type and level of risk as the original requirement statement, so a risk analysis that argues the gap is small needs to show exactly which risk the original statement targets and how your control covers it. The second is duplication: the control must not be something other requirement statements in the same assessment already require, so map your proposal against the rest of your assessment before you submit. The third is evidence maturity: a control that has run consistently, with dated, retrievable records, is far easier to defend than a design on paper. Ask your assessor early which of these points they expect the committee to probe, and confirm the current submission process with HITRUST directly, since the details are set in the Assessment Handbook.
What the alternate control submission process involves
The sequence moves from proving a requirement cannot be met as written to a documented committee decision that the assessment can rely on. Each phase produces a record that the next phase depends on, so gaps at the start tend to surface as rejections later.
Confirm the requirement cannot be met as written
Start by reading the requirement statement against your actual environment, including the systems, facilities and third parties in scope. Document why the requirement cannot be implemented as written, such as a technical limit of a legacy platform or a contractual constraint outside your control. Someone accountable for the control, usually the control owner with security sign-off, should approve this finding. The output is a short written determination that names the requirement statement and the specific barrier. If the barrier is simply that the control is inconvenient or unfunded, stop here, because that is not a basis for an alternate control.
Design a control of similar type and level of risk
Design a compensating control that addresses a risk of similar type and level to the original requirement statement. It must also be something other than a control that another requirement statement in the same assessment already requires, so review the existing control set before you settle on a design. Map the proposed control to the risk the original requirement was meant to reduce, and state what it does, who operates it and what evidence it will generate. The output is a control description that a reviewer can test against the original intent.
Write the risk analysis for the compensating control
Prepare a risk analysis that explains the residual risk left after the compensating control operates, the threats it still does not address and why the overall exposure is acceptable to the organization. Name the risk owner who accepts that residual exposure, and record the review cycle for the analysis. The analysis should be specific enough that an independent reviewer can reach the same conclusion from the document alone. The output is a signed or approved risk analysis tied to the proposed control.
Submit to HITRUST at least 30 days before fieldwork
Submit the compensating control description and the risk analysis to HITRUST no later than 30 days before validated fieldwork begins. Confirm the submission route and format with your External Assessor and HITRUST before sending, because the submission must reach HITRUST within that window to be considered. Keep the submission receipt and the exact version of the documents sent. The output is a dated submission record. A submission that arrives later than the 30-day point risks delaying the assessment, so plan the design and analysis work backward from the fieldwork start date.
Await review by the Alternate Controls Committee
An Alternate Controls Committee made up of HITRUST leadership and subject matter experts reviews the submission and decides whether to accept the compensating control. Expect questions about how the control matches the risk of the original statement, how it is operated and how its effectiveness will be shown. Respond to these questions in writing through the designated channel, and keep every exchange in the assessment file. The output is a committee decision of acceptance or non-acceptance, which you should confirm in writing before fieldwork relies on it.
Carry the decision into the assessment and the evidence plan
Once the committee decides, record the outcome against the affected requirement statement in your assessment documentation and update the evidence plan so the compensating control is tested as implemented. Confirm with your assessor how the control will be sampled and what evidence period applies, since the normal control maturity and incubation rules still govern how the control is tested. If the committee does not accept the control, decide with the assessor whether a corrective action plan or a documented accepted risk is the appropriate route for that requirement. The output is an updated requirement record that reflects the committee outcome and a tested evidence plan.
Which alternate controls the committee can accept
The Alternate Controls Committee judges every submission against a small set of tests. Each card below covers one test or one part of the package you send, so you can check a proposed control before you submit it.
Similar type and level of risk
The first test asks whether the compensating control addresses a risk of the same type and at about the same level as the requirement statement it replaces. A control that reduces a different risk, even a serious one, does not substitute. Start by writing down the risk the original statement addresses, then show how your control addresses that same risk at a comparable level. Confirm the expected level of rigor with your assessor before you invest in the control.
No overlap with other requirements
The second test rules out using a control that other requirement statements in the same assessment already require. Reusing an existing control as the substitute can look efficient, but the committee treats it as unacceptable because it adds no new protection. Map your proposed control against the full assessment to confirm it is distinct. If the control is already in use elsewhere, describe a separate mechanism or a different scope of coverage, and confirm this with your assessor.
Documented risk analysis
Every submission needs a risk analysis that explains the gap, the threat the original statement covers, and why the compensating control reduces that threat to an acceptable level. Keep the analysis specific to your systems, data and facilities rather than generic. An analysis that reads as boilerplate is a common reason a submission is returned for more detail. Have the risk owner sign the analysis so the decision is traceable.
Evidence that shows the control runs
A compensating control has to be testable, so define in advance what the assessor will examine: configuration exports, logs, approval records, review sign-offs or test results. State how often the control operates and who performs it. Confirm with your assessor which evidence types they will accept and what time period must be covered, because a control that cannot be shown to run will not be credited during fieldwork.
Ownership and review over time
The committee looks for a named owner who is accountable for the compensating control and who will keep it operating after certification. Record who approves exceptions, how the control is reviewed, and what triggers a change to it. A control with no owner tends to lapse, and a lapsed control can invalidate the approval. Plan the review cadence before you submit so the approved design is what runs in production.
Alternatives when a control is rejected
If the committee does not accept a compensating control, the remaining options are a corrective action plan or, for some items, an accepted risk with a documented risk analysis. A corrective action plan needs a specific, measurable action, an owner, a status and a scheduled completion date. Ask your assessor which path applies to each rejected item before fieldwork, because the score impact differs between them.
Alternate control, corrective action plan or accepted risk: which path fits
Use an alternate control when you cannot implement a requirement statement as written but can meet the same underlying risk another way. You submit the proposed control with a risk analysis to HITRUST at least 30 days before validated fieldwork begins. An Alternate Controls Committee, made up of HITRUST leadership and subject matter experts, decides whether to accept it. The committee does not approve controls informally, so a late or thin submission can leave you without an answer when fieldwork starts.
- Similar risk and level: The alternate control must address a similar type and level of risk as the original requirement statement.
- No duplication: It cannot be a control that other requirement statements in the same assessment already require.
- Documented risk analysis: Explain the residual risk, why the original requirement cannot be met, and how the alternative reduces that risk.
- Timing: Submit at least 30 days before validated fieldwork, and allow for questions from the committee.
- Operating evidence: Plan how the alternate control will be evidenced and how long it must run before testing, since the usual incubation rules still apply.
Before you submit, confirm the current submission process and any templates in the HITRUST Assessment Handbook, and ask your assessor whether they expect to discuss the proposal during planning.
A corrective action plan, or CAP, is the right path when a requirement has a real gap that you can close with a defined piece of work. The CAP records what will change, who is accountable and when it will be finished. It is documented within the assessment, so it shows an assessor and QA that the organization knows where it stands and has a credible plan. A CAP is not a way to defer work indefinitely, and it does not change the score of the item it covers.
- Specific, measurable action: Describe the change in terms that can be verified, such as a configured setting, a signed procedure or a completed review cycle.
- Status: Record where the action stands, for example not started, in progress or complete.
- Owner: Name one accountable person or role, not a team alias.
- Scheduled completion date: Set a realistic date that you can meet and that fits the assessment timeline.
- Follow-through: Keep the completed evidence ready, because a CAP that closes without proof will not help the item.
Ask your assessor how CAP items are handled in your specific assessment type and confirm the field requirements in the current Handbook before you commit to dates.
Accepted risk applies when a requirement that would otherwise need a CAP scores 62 or higher and the organization decides to carry the remaining risk. The Handbook allows this only with a documented risk analysis. This is a business decision that the organization owns, not a finding that HITRUST or the assessor makes for you. Your leadership, not the assessor, must accept the residual risk, and the record should show who made that decision and why.
- Score threshold: Confirm that the item scores 62 or higher before treating it as an accepted risk, because lower-scoring items still need a CAP.
- Documented risk analysis: Describe the threat, the existing mitigations, the residual exposure and the consequences of not acting.
- Ownership: Name the executive or risk owner who accepts the risk, and record their approval.
- Review trigger: Define what would reopen the decision, such as a security incident, a change in data or a new regulatory obligation.
- Honest reporting: Accepted risk is visible to customers reading the report, so do not use it to hide a gap that customers would consider material.
Confirm the threshold, the required content and approval steps with your assessor before the assessment, since they may ask to see the decision record during fieldwork.
What an implementation partner prepares and what it cannot decide
An implementation partner can do the preparation work that makes a compensating control request credible. Starting from the requirement statement you cannot meet as written, a partner can map the gap against your current systems, draft the alternate control design, assemble the risk analysis package and collect the evidence that shows the control runs in its current state. For the design and evidence work, the partner's output is a set of documents and configurations inside your environment, such as a control description, the monitoring or approval workflow that enforces it, and the records that prove it operates. Your team should review each artifact for accuracy, because the design must describe what your organization really does.
Several decisions stay with your organization and cannot be delegated. You own the control, the residual risk and the decision to accept it. Your leadership must also confirm that the alternate control addresses a similar type and level of risk as the original requirement and does not duplicate a control another requirement statement already relies on. The Alternate Controls Committee of HITRUST leadership and subject matter experts decides whether to accept the submission. Neither the partner nor your assessor can make that call, and no preparation work guarantees approval. Plan a fallback, such as a corrective action plan or a documented risk acceptance where the scoring rules allow it, before you submit.
Only an Authorized HITRUST External Assessor can perform the validated assessment that is submitted for certification, and HITRUST performs quality assurance before any report is issued. Your partner does not test the control on the assessor's behalf, and it does not issue or attest to the outcome. Ask any partner to confirm in writing which deliverables it prepares, which decisions remain yours, and that it will not represent a committee decision as settled. Confirm the current submission timing and procedure in the HITRUST Assessment Handbook and with your assessor before setting a schedule.
What must be in place before you submit
An alternate control request is only as strong as the groundwork behind it. The checks below cover whether the requirement truly cannot be met, whether the replacement control has run long enough to be tested, and whether the paperwork and dates fit the fieldwork window.
Confirm the requirement cannot be implemented
Start by proving the requirement statement is genuinely unimplementable in your environment, not merely inconvenient or expensive. Document the specific technical, contractual or platform limit that blocks it, and check that the limit applies to every system and facility in scope. A reason that only covers part of the scope will weaken the request, so write down what you tried and why each attempt failed.
Confirm the alternate control is operating
The proposed alternate control should be running now, or have a credible plan to start. Controls must run in their current state for 90 consecutive days before they can be tested as implemented, and policies and procedures need 60 days, with no partial credit for a shorter period. Confirm that the run period will finish before your planned fieldwork, or that the committee will see the control in its current state.
Show the alternate control matches the risk
The control must address a similar type and level of risk as the original requirement statement. It also cannot simply repeat a control that another requirement statement in the assessment already requires. Map the original risk, the new control and the residual gap side by side, so a reviewer can see the match without guessing.
Write the compensating control risk analysis
The submission must include a written risk analysis that explains the threat, the affected assets and how the alternate control reduces that threat. Name the owner who accepts the residual risk and the evidence that will prove the control runs. A vague analysis is the most common reason a request stalls, so keep the reasoning specific to your systems.
Calendar the submission against fieldwork
Submit the compensating controls and risk analysis at least 30 days before validated fieldwork begins. Work backward from the planned fieldwork window, which can run at most 90 days, and allow time for the committee's decision and any follow-up questions. Confirm the current submission format and process with HITRUST before you start, since the committee's requirements can change.
Common questions about HITRUST alternate controls
Is an alternate control the same as marking a requirement N/A?
No. An N/A decision says a requirement statement does not apply to your environment, and it needs a rationale covering every system, facility and third party in scope. An alternate control applies when the requirement does apply but you cannot implement it as written, so you propose a different control that addresses a similar type and level of risk. Under the HITRUST Assessment Handbook, an alternate control must also be something other than what other requirement statements in the assessment already require. If the requirement applies and your environment truly cannot meet it, the compensating control route is the one to consider, not N/A. Confirm with your assessor which path fits each statement before you write anything up.
What does the 30-day deadline mean in practice for an alternate control?
The compensating controls and their risk analysis must reach HITRUST at least 30 days before validated fieldwork begins. Counting backward from your planned fieldwork start is the first step. If fieldwork is scheduled for a given date, the submission must already be with HITRUST 30 days earlier, so the committee has time to review it before testing starts. Late submissions push the timeline, and the team may need to resolve the gap with the assessor in the meantime. Ask your external assessor which internal dates they need, how they count the window, and whether they want a draft review before the formal submission.
Can a partner prepare the alternate control submission for us?
Yes, an implementation partner can help prepare the technical design, the control description and the supporting evidence that the submission needs. DeployOpen plans, implements and documents self-hosted open-source platforms in your own infrastructure, so it can help build the compensating control and collect the evidence that shows it operates. The organization still owns the control, the risk decision and the submission itself. Only HITRUST, through its Alternate Controls Committee, decides whether a control is accepted, and only an authorized External Assessor performs the validated assessment. A partner cannot issue or guarantee acceptance, so ask for the scope of help in writing before work starts.
What effort and documentation must our organization supply?
The organization supplies the business reason the original requirement cannot be met, a description of the compensating control, and a risk analysis showing that the alternate control addresses a similar type and level of risk. Expect to provide evidence that the control is designed well and runs in practice. Named owners, system and facility references, and clear links to the requirement statement help the committee review quickly. Effort depends on how many statements are affected, how complex the controls are and how well existing evidence maps to them. Ask your assessor which artifacts they expect and how many rounds of review to plan for.
What happens if the Alternate Controls Committee declines our control?
If the committee does not accept the compensating control, the requirement statement stays open and must be addressed another way before testing. Your options are typically to implement the original requirement, to revise the alternate control and resubmit within the timeline, or to record the gap in a corrective action plan. A CAP records a specific, measurable action, its status, an owner and a scheduled completion date. Where a CAP-required item scores 62 or higher, the entity may instead accept the risk with a documented risk analysis. Confirm with your assessor how these paths affect your certification outcome before you decide.
Does an accepted alternate control stay valid for every future assessment?
Do not assume it does. An accepted alternate control was reviewed against a specific requirement statement, environment and risk analysis. If systems, facilities, data flows or third parties change, the control may no longer address the same risk, and that can count as a change you must raise with your assessor. Confirm with HITRUST or your assessor how acceptance carries into later assessments and CSF versions, because requirement statements can change between versions. Keep the risk analysis and control evidence current so you can show the committee's decision still fits your environment.
Can we run the alternate control submission ourselves without an outside party?
Yes, the organization can prepare and submit its own compensating controls, since HITRUST does not require a consultant for this step. The harder part is the risk analysis and evidence. Teams without a clear view of the requirement's intent often struggle to show a similar type and level of risk. An internal reviewer who has not written the control, or an outside readiness reviewer, can test whether the argument holds before it goes to the committee. Whichever route you take, the final validated assessment still requires an authorized External Assessor, and HITRUST performs quality assurance before issuing any report.
How DeployOpen prepares compensating controls and evidence
DeployOpen helps organizations that cannot implement a HITRUST requirement statement as written prepare the alternate control, its risk analysis and the evidence that shows it runs. The organization owns the decision and the submission to HITRUST, and only an authorized External Assessor performs the validated assessment that tests the control.
How we scope
- Confirm which requirement statement cannot be implemented as written and document the business reason in the written scope.
- Define the systems, facilities and third parties the alternate control touches, so the risk analysis covers the same boundary as the assessment.
- Agree deliverables, timelines and responsibilities in writing before work starts, since most engagements are fixed-scope.
How we build
- Design an alternate control that addresses a similar type and level of risk as the original requirement statement.
- Check that the proposed control does not duplicate a control another requirement statement already requires in the assessment.
- Implement the control on self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
How we hand over
- Produce the risk analysis and control documentation that your organization reviews and submits to HITRUST at least 30 days before fieldwork.
- Map evidence to the requirement statement, with dated records showing the control ran in its current state for the required period.
- Hand over runbooks, owners and review schedules so your team can maintain the control and answer assessor questions.
How we support
- Support your team through questions from the External Assessor and any Alternate Controls Committee follow-up, while the decision stays with HITRUST.
- Offer ongoing support, upgrades and continuous testing as a retainer if the control must keep running after certification.
- Confirm with HITRUST and your assessor which version of the CSF and assessment handbook applies to your submission before you finalize documents.
