HITRUST evidence requirements: what assessors and QA accept

Every piece of evidence in a HITRUST validated assessment has to fit inside a fieldwork window, and that window is set by dates you may not control on the day you start. External Assessor testing must fall within a 90-day fieldwork period that ends when your organization signs the management representation letter. That letter must be dated within two weeks after fieldwork ends. In practice, this means the assessor cannot accept a configuration screenshot, a system parameter export or a signed approval dated before the window opens, and anything collected after the letter has no standing for that assessment. Ask your External Assessor to confirm in writing the planned fieldwork start, the expected end date and the letter date, and check whether any evidence you are preparing now will still fall inside that range.

Point-in-time evidence, such as a screenshot of a firewall rule, a patch level report or an access review sign-off, must be dated within the fieldwork period. Inquiry alone does not satisfy a requirement, so the date on each artifact is part of its acceptability, not a formality. Time-based populations need a different check. For controls that operate over time, such as backup jobs, change tickets or joiner and leaver records, the sampling period must cover at least 90 days, and that period cannot start more than one year before fieldwork begins. A backup log exported for a single week will fail that test even when every backup succeeded. Before fieldwork, pull the population for each time-based control, confirm it spans the required period, and confirm with your assessor which records they will draw from it.

Plan backward from the fieldwork window rather than forward from the evidence you already have. Set the planned fieldwork dates first, then work out the earliest date on which each population can legitimately begin, and make sure controls you changed recently have run long enough to be tested. If a control was remediated shortly before fieldwork, its earlier records may not be usable, so the population may need to start after the change. Record these dates in your evidence register so that any mismatch appears months before the assessor arrives, not during QA.

Every exception an assessor finds during a HITRUST validated assessment must be reflected in scoring, and the usual way is by lowering the strength or coverage recorded against the affected requirement statement and maturity level. An exception is not a pass or fail verdict on its own. It is an input to the scoring that decides whether the certification is issued, so a single gap in one requirement can move a domain score even when the rest of the evidence is clean. Under the Assessment Handbook, these scoring changes are discussed and agreed with the entity's management, which means the organization has a formal chance to respond before the result is final.

For your team, the practical question is which exceptions you can still answer during fieldwork. Before the assessor closes testing, check each open finding against the evidence already uploaded to MyCSF. Ask whether the evidence is dated within the fieldwork period, whether the policy cited is final and approved, and whether the sample covers the required period. If the gap is real, decide early whether to remediate it within the window, document it accurately, or accept the scoring impact. Confirm with your assessor how they plan to record each exception and what evidence would change the recorded strength or coverage.

Scoring guidance explains how strength and coverage combine into domain results and what it takes to pass each domain. Read it before fieldwork starts rather than after the first draft of findings arrives, because the thresholds shape which exceptions matter most. Ask your external assessor to walk through the scoring logic with you so the discussion with management happens against a shared understanding of how each finding moves the result.

The authoritative source for evidence rules is the HITRUST Assessment Handbook, version 1.1. Read the chapters on evidence, sampling, fieldwork and scoring before you decide what to collect, and treat any summary on a vendor blog or in a readiness deck, including this page, as a secondary read. The Handbook sets out the rules that QA applies, such as why inquiry alone does not count, how dated point-in-time evidence must fall within fieldwork, and how exceptions move scores. Keep a copy with the version number on file so your team can show which rules governed your assessment.

For context on what the CSF is and how the e1, i1 and r2 fit together, start with the HITRUST CSF framework page. It explains the framework's purpose and structure but does not settle evidence questions, so use it to orient new team members rather than to answer a specific upload or sampling question. Where the two sources differ in emphasis, the Handbook governs the assessment.

Before fieldwork begins, confirm the current evidence rules with your External Assessor in writing. Ask which Handbook version and CSF version they will apply, how they want evidence uploaded to MyCSF and linked to each requirement statement and maturity level, which items they expect translated into English, and whether any of your evidence would require Live QA. Ask them to name the individuals who will review your uploads and how scoring changes will be discussed with your management. An implementation partner can help you prepare the evidence, but only the External Assessor can tell you what their engagement will accept.