What a HITRUST readiness assessment is and who can perform it
A customer or contract now asks for HITRUST, and the first question is whether you need a readiness assessment before you book a validated assessment. A readiness assessment is an optional gap check against the CSF that HITRUST does not quality-assure, so it exists to find and fix gaps before the validated assessment rather than to produce a certifiable result. It can be performed by a Readiness Licensee, which HITRUST licenses to use the CSF for readiness work and advisory services but not for validated assessments, or by an Authorized HITRUST External Assessor organization, which can also carry out the validated assessment itself.
Whether you need one, and who should run it, depends on three things: the scope you intend to certify, your current maturity against the requirement statements, and whether you want HITRUST to generate a report from the readiness work. The HITRUST Assessment Handbook recommends a readiness assessment to establish current maturity before pursuing certification, given how granular the CSF requirements are. Submitting the readiness assessment to HITRUST for a report is optional, so decide that before work starts, because it changes what the provider delivers and how the output is documented. Ask any provider to state in writing which of these two roles it holds and what it will deliver at the end.
Confirm the provider's license status against HITRUST's Find an External Assessor or Readiness Licensee listing before you sign, and check whether the same firm will also perform the validated assessment. That choice has consequences for independence and for what the assessor may do afterwards, which the Handbook limits in specific ways. Ask for the gap list, the maturity reasoning behind each finding and the remediation support you will and will not receive, and agree those points in writing with a fixed scope and deliverables.
How a readiness assessment fits the path to certification
HITRUST's Getting Started sequence moves an organization from choosing an External Assessor through a readiness assessment, a secured QA date and gap remediation, so that the validated assessment starts with known gaps and a settled scope.
Choose an External Assessor
Select an Authorized HITRUST External Assessor organization for the validated assessment and, if you want outside help before it, confirm whether the firm also holds a readiness license for the readiness work. Only an Authorized External Assessor can perform the validated assessment that HITRUST accepts for certification, so this choice shapes the rest of the path. Done means a signed engagement letter that names the assessment type, the scope in outline and the people from each side who will run it. Confirm the expected durations with the firm and with HITRUST, since no timeline is fixed here.
Buy a MyCSF subscription and report credit
Set up the organization's MyCSF subscription and purchase the report credit needed for the assessment type you intend to pursue. MyCSF is where scoping, requirement statements, evidence and results live, so it needs named administrators and users before work begins. Done means your team can log in, see the requirement statements for the chosen assessment and assign owners. Ask HITRUST and your assessor to confirm current subscription and credit terms, because these are set by HITRUST and not by DeployOpen.
Run the readiness assessment with scoping
Perform the readiness assessment against the CSF requirement statements to measure current maturity and find gaps before certification. During this phase you also define the systems, facilities and locations in scope and record which controls are inherited from cloud providers, vendors or earlier reports. Readiness output is internal: HITRUST does not perform quality assurance on it, and submitting it to generate a report is optional. Done means a documented gap list, a draft scope and an inheritance plan that the assessor has reviewed.
Plan inheritance and shared responsibility
Using the readiness results, decide which requirements you will inherit from providers and which you will test yourself, and document the shared responsibility split for each. Confirm that each inherited result is one the validated assessment can rely on, because reliance depends on the provider's own HITRUST or equivalent results and on how the assessor reads them. Done means a reviewed inheritance matrix that the assessor accepts as the basis for testing. Ask the assessor which provider results it will accept before you rely on them in planning.
Secure a QA date with HITRUST
Once scope and inheritance are settled, book a quality assurance date with HITRUST for the validated assessment. QA is the central review HITRUST performs before issuing any report, so the date you secure fixes the point by which your evidence and results must be ready. Done means a confirmed QA date in writing and a working plan that ties each remaining task back to it. Confirm with HITRUST how far in advance dates are set and what happens if the schedule moves.
Remediate gaps before fieldwork
Work through the gaps from the readiness assessment by implementing or fixing controls, collecting evidence and documenting exceptions or alternate controls where a requirement cannot be met as written. Controls that are new or changed usually need time to run before they can be tested, so start remediation early enough for that period to pass before fieldwork. Done means a re-run of readiness on the remediated requirements shows that the open gaps are closed or formally accepted. Your team owns these controls; a consultant or readiness licensee can advise and prepare evidence but cannot implement or operate the controls for you.
Enter the validated assessment
With gaps closed and evidence in place, the External Assessor runs the validated assessment within its fieldwork window, which the Assessment Handbook sets at a maximum of 90 days for e1, i1 and r2. The assessor tests the requirements in MyCSF, and HITRUST performs quality assurance before any report is issued. Done means the assessor's fieldwork is complete, HITRUST QA has accepted the submission and only then is a report or certificate issued. Ask your assessor to confirm the fieldwork plan and the expected QA steps in writing.
Who may perform a HITRUST readiness assessment
A readiness assessment can be run by several kinds of party, but each carries a different status for what it may do and whether its results count. The cards below set out the three routes and the condition that governs outside testing on management's behalf.
Readiness Licensee
A Readiness Licensee is licensed by HITRUST to use the CSF for readiness assessments and advisory services. It can help you find gaps, plan scope and prepare evidence, but it does not perform validated assessments, so it cannot produce the work that HITRUST accepts for certification. Before engaging one, confirm the license covers the work you are buying and that a separate External Assessor will perform the validated assessment later.
Authorized External Assessor
Only Authorized HITRUST External Assessor organizations may perform the validated assessments submitted for certification. An Authorized External Assessor can also perform a readiness assessment, and its readiness results can be relied on as management's testing. Check that the firm holds current authorization and ask who will sign the work, since HITRUST performs central quality assurance on the validated report before issuing it.
Outside party as agent of management
An outside party may test on management's behalf, such as through staff augmentation, if it works as an agent of management rather than as an independent reviewer. This route suits a team that needs extra hands for gap work while it keeps ownership of its controls and results. Confirm the contract places the party under management's direction, because testing by a party that meets none of the three conditions cannot be relied on.
The reliance condition
An outside party testing on management's behalf can be relied on only if it is an Authorized External Assessor, holds a HITRUST readiness license for the engagement, or works as an agent of management. A consultant that meets none of these may still give useful advice, but its test results will not stand as evidence of readiness. Ask the provider which of the three conditions applies before work starts, and record the answer in the statement of work.
Verify status before engaging
Status is what determines what a provider may do, so verify it rather than relying on a logo or a sales claim. Check HITRUST's assessor directory for the firm's current listing, confirm the named staff and their roles, and ask for the license or authorization details in writing. Repeat the check before the validated assessment, because the status of a firm can change between readiness work and fieldwork.
How a readiness assessment differs from a targeted self-assessment
A HITRUST readiness assessment is a preparation exercise for an e1, i1 or r2 validated assessment. It measures current maturity against the CSF requirement statements so the organization can find and fix gaps before an External Assessor tests the controls. Its output is an internal picture of where the organization stands, not a certification. HITRUST does not perform quality assurance on readiness work, and submitting one to HITRUST to generate a report is optional.
- Purpose: It identifies maturity gaps, scoping questions and inheritance opportunities before the validated assessment begins.
- Certifiable path: It is the groundwork for an e1, i1 or r2 that can lead to a certification.
- Who performs it: Authorized External Assessor organizations or Readiness Licensees can perform it, depending on the engagement.
- Reporting: Submitting it to HITRUST for a report is optional, so the organization decides whether to do so.
- Best fit: Organizations that have a customer or contract requirement for HITRUST and need to learn their current position first.
Before you buy, ask the provider to confirm its licensing status for the specific engagement and what the deliverable will look like.
A HITRUST targeted assessment is a non-certifiable self-assessment. It is built from requirement statements mapped to authoritative sources the entity selects, such as NIST SP 800-171, FedRAMP or HIPAA. The organization chooses the sources that matter to its customers, regulators or contracts, and the assessment checks its controls against those mappings. Because it cannot lead to a HITRUST certification, it answers a different question from a readiness assessment.
- Source selection: The organization picks the authoritative sources that define the scope of the assessment.
- No certification: A targeted assessment cannot lead to an e1, i1 or r2 certification.
- Self-driven: It suits organizations that need evidence against a specific source rather than the full CSF.
- Narrower content: It covers only the requirement statements mapped to the chosen sources.
- Best fit: Organizations whose obligations center on one framework and who do not need a HITRUST certificate.
Confirm with HITRUST which targeted assessment options and mappings are current before committing to a source.
The choice depends on what the organization must show and to whom. If a customer, contract or regulator asks for a HITRUST certification, a readiness assessment is the step that prepares for a validated assessment, because only a validated assessment can produce the certification. If the requirement is evidence against a particular source, a targeted assessment may match the need without the cost of the full CSF. Some organizations run a readiness assessment first to decide which path makes sense.
- Certificate required: Start with a readiness assessment and plan toward an e1, i1 or r2.
- Source evidence required: Consider a targeted assessment mapped to that source.
- Unsure: Use a readiness assessment to learn the current maturity, then decide.
- Mixed needs: Ask whether the CSF requirements already cover the chosen sources before running two separate efforts.
- Documentation: Keep the written rationale so the decision is clear to auditors and customers.
Check the customer or contract wording exactly, since it will determine whether a certification or a self-assessment satisfies the request.
What the assessor may still do after a readiness assessment
An External Assessor that performs a readiness assessment for an organization is not barred from working for that organization afterwards. The HITRUST Assessment Handbook allows assessor staff on a validated assessment to keep providing policy and procedure consulting, penetration testing, vulnerability scanning, and further readiness or gap assessments to the same entity. For a buyer, this means the assessor can keep testing and advising you after a validated assessment, but the assessor's independence in the validated work is what gives the eventual report its weight. Confirm in writing which of these services the assessor will offer, and whether any of them would overlap with the requirements it will later test.
The exclusion is remediation. The assessor may not write your policies and procedures, implement your controls, or operate them. Those tasks belong to the organization, or to a separate party you engage for them, such as an implementation partner that prepares systems and evidence without issuing any assurance. Ask the assessor to name, in the engagement letter, who will draft each policy, who will configure each technical control, and who will operate it day to day. If the same firm is asked to do both, the work may be inside the prohibited set and could be questioned during quality assurance.
You own your controls and the evidence that supports them. An assessor issues no report on its own remediation work, and a readiness assessment is not a validated result. Its findings are internal planning input: they tell you where maturity falls short and what to fix before fieldwork. Any HITRUST report comes only from the validated assessment, which HITRUST quality-assures before it is issued. Before you accept a second engagement from your assessor, decide how you will keep the readiness findings, the remediation record and the validated assessment separate, so that no one can read a gap closed by the same firm that later tested it as independent confirmation.
Who owns the controls, the readiness work and the report
A HITRUST readiness assessment involves four parties with different jobs. The organization owns the controls and the evidence, an implementation partner helps prepare them, an Authorized External Assessor runs any validated assessment, and HITRUST performs quality assurance and issues the report.
The organization owns controls and evidence
The organization operates its controls, decides its scope and is accountable for every requirement statement it claims. Policies must be approved by management, and evidence must show the controls actually operated. Before any outside party starts, confirm internally who signs off the scope, who owns each domain and who will answer assessor questions after the work ends.
Implementation partner prepares systems
An implementation partner such as DeployOpen can prepare systems, documentation and evidence and run readiness testing within a written scope. Work is typically fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. A partner does not issue reports, attestations or certificates, and it does not replace the organization's own accountability for its controls.
Authorized External Assessor runs validation
Only Authorized HITRUST External Assessor organizations may perform the validated assessments submitted for certification. The assessor tests controls against the CSF, and its fieldwork window for e1, i1 and r2 is at most 90 days. Check the firm's authorization on HITRUST's assessor directory before signing, and confirm that its staff are independent of any remediation work performed for you.
HITRUST performs quality assurance
HITRUST performs central quality assurance on validated assessments before it issues a report. HITRUST does not perform quality assurance on readiness assessments, and submitting a readiness assessment to HITRUST for a report is optional. Ask your partner which outputs are internal working papers and which, if any, would be submitted for a validated report, since that determines what the assessor and HITRUST will review.
Questions buyers ask about HITRUST readiness assessments
Is a HITRUST readiness assessment required before certification?
No. HITRUST does not list a readiness assessment as a prerequisite for a validated assessment. The HITRUST Assessment Handbook does recommend one, because the granularity of CSF requirements makes it hard to judge current maturity without testing it first. HITRUST's Getting Started checklist places it in a sequence: choose an External Assessor, buy a MyCSF subscription and report credit, run a readiness assessment with scoping and inheritance planning, secure a QA date, then remediate gaps before the validated assessment. Skipping the readiness step removes the early view of where controls fall short, so the first validated assessment carries more risk of surprises. Confirm the sequence and timing with your External Assessor, who will set dates against its own engagement plan.
Does HITRUST review or approve our readiness assessment?
No. HITRUST does not perform quality assurance on readiness assessments. Their purpose is to find and fix gaps before a validated assessment, so nothing is scored against a pass line and no certification follows from one. Submitting a readiness assessment to HITRUST to generate a report is optional. If you choose that submission, treat the output as a separate product from a validated assessment result. In most programs, readiness output is an internal working document: a maturity view, a gap list and a remediation plan. Keep that framing in contracts and board reporting so nobody reads a readiness result as a certification claim. Ask the firm doing the work which deliverables it will hand over and whether any of them carry HITRUST branding.
Can our own team run a HITRUST readiness assessment in-house?
Yes, an organization can run its own readiness work, because its purpose is internal gap finding. The constraint is on the record, not the effort. A readiness assessment only helps a validated assessment if its results are credible, and the Handbook says outside parties can be relied on only in specific cases: an Authorized HITRUST External Assessor, a firm holding a HITRUST readiness license for the engagement, or an agent of management working through staff augmentation. Your internal team needs people who understand the requirement statements, scoring and evidence rules well enough to find the gaps an assessor would find. Plan for the cost of MyCSF subscription and report credits either way, and ask HITRUST to confirm current pricing, since no figure is set out here.
Can the firm that ran our readiness assessment also perform our validated assessment?
Possibly, but confirm it in writing before you sign. The Handbook says staff on a validated assessment may still provide readiness or gap assessments to the same entity, along with policy consulting, penetration testing and vulnerability scanning. The exclusion is remediation: writing the entity's policies or implementing and operating its controls. A firm that built or wrote the controls it will later test sits on the wrong side of that line. The validated assessment itself must be performed by an Authorized HITRUST External Assessor. Ask each candidate which role it holds for your engagement, whether it is an External Assessor or a Readiness Licensee, and how it documents its independence. Readiness Licensees do not perform validated assessments. Check the current listings on the HITRUST directory before you decide.
What does a readiness assessment need from our team?
A readiness assessment depends on four inputs from your organization:
- Named owners for each system, facility and domain in the proposed scope, with authority to approve remediation
- Current policies, procedures, configurations and sample evidence, so the reviewer can test what runs today
- Time from the people who operate the controls, not only compliance staff, because operators know where practice departs from documentation
- Early decisions on scoping and inheritance planning, since these shape which requirements apply and how much work follows
The main cost is staff time, and it recurs whenever systems change and the readiness picture goes stale. Ask any provider for a written scope listing deliverables, roles, assumptions and what your team must supply, so you can compare quotes on the same basis.
How does a readiness assessment differ from a targeted assessment?
A readiness assessment prepares you for a validated, certifiable assessment against the full CSF, with the aim of e1, i1 or r2 certification. A targeted assessment is a different instrument. It is a non-certifiable self-assessment made only of requirement statements mapped to authoritative sources the entity selects, such as NIST SP 800-171, FedRAMP or HIPAA. Choose readiness when a customer or regulator expects HITRUST certification. Choose a targeted assessment when a specific framework is the requirement and you need a bounded self-assessment against it. Because the targeted result carries no certification, do not present it as one. Confirm with HITRUST and your provider which output you will receive before work starts, so the deliverable matches the claim you need to make.
Where does DeployOpen fit in a HITRUST readiness engagement?
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For compliance work, it prepares systems, controls and evidence for an assessment. It does not issue reports, attestations or certifications, and only an independent assessor can do that. Whether DeployOpen can deliver any part of a HITRUST readiness assessment, including under a HITRUST license or as an agent of management, must be confirmed before scope is agreed. Engagements are fixed-scope, with scope, deliverables and timelines set in writing before work starts. DeployOpen publishes no price list, so a quote follows from that written scope. Ask for the licensing position in the proposal.
How DeployOpen prepares your environment for a HITRUST readiness review
DeployOpen is a Chainscore Labs company that plans, implements, hardens and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a HITRUST readiness review, that means preparing the systems in scope and the evidence that shows how they run, so your team and any readiness provider can measure current maturity against the requirement statements. Our work covers platform configuration, access paths, logging and backup settings, and documentation of how each control is operated. Before any work starts, scope, deliverables and timelines are agreed in writing, so you know which systems, facilities and controls are being prepared and what you will receive at the end.
DeployOpen does not hold a HITRUST readiness license or External Assessor status unless that is confirmed in writing for a specific engagement. Confirm this before you sign, and ask whether the readiness work will be run by a Readiness Licensee or an Authorized External Assessor. Readiness work done by a licensed party can be documented as a readiness assessment, while preparation work we perform is delivered as system and evidence readiness. Those are different roles, and your scope letter should say which one applies. Your organization still owns its controls, its policies and the decisions about what is in scope. Check the HITRUST Find an External Assessor page to verify the status of any party you engage.
Only an independent assessor issues the HITRUST report. DeployOpen can help you prepare for a validated assessment by making systems and evidence ready for review, but we do not perform validated assessments, do not submit results to HITRUST for certification and do not issue reports or certificates. Any readiness output, including gap lists and remediation plans, is a working document for your team, and HITRUST does not perform quality assurance on it. Plan for the validated assessment with an Authorized External Assessor, and treat our preparation deliverables as inputs to that engagement rather than as evidence of certification.
