Can your HITRUST assessor also do your HITRUST readiness work?
Your validated assessor may do some readiness and gap work for your organization, but it may not write your policies, implement your controls or operate them. Before you sign with any firm, confirm in writing which of those roles it will play on the validated assessment and which it will play on a separate engagement. HITRUST requires the External Assessor firm to be a separate legal entity from the assessed organization, and the assessor function must be independent of the functions it tests, with no overlap in responsibilities, staffing, control ownership or reporting. Assessor staff may still provide policy and procedure consulting assessments, penetration testing, vulnerability scanning and readiness or gap assessments to the same entity, as long as they do not remediate findings for you.
Three facts decide the answer for a specific firm. First, did the firm build or run any of the controls being assessed? If its people designed, implemented or operated a control, that person may not work on the validated assessment, and the firm must use a separate team. Second, did any of its staff touch those controls in the prior 12 months? That look-back period is the rule to test against the firm's staffing history, not just its current team. Third, is readiness a separate engagement with its own scope, deliverables and engagement executive? A readiness gap assessment is permitted, but a readiness project that drifts into writing controls turns the assessor into a control owner and removes its independence.
Your own due diligence duty does not transfer to the assessor. HITRUST makes the assessed organization responsible for checking an External Assessor before engaging it, and HITRUST cannot guarantee that any assessor will succeed on your engagement. Ask the firm to show its authorization status on HITRUST's find an External Assessor listing, request a written independence statement covering the 12-month rule, and confirm that management cannot limit the testing the assessor decides is required. Keep those answers in your third-party risk file. If the same firm will also help prepare your evidence, document which team does which work before the validated assessment begins.
What an External Assessor may still provide to the same entity
An External Assessor can do some support work for the organization it validates, but the boundary is set by HITRUST's independence rules. The cards below list what stays permitted and the one category that is excluded, so you can check any proposed scope before signing.
Policy and procedure consulting assessments
The assessor may review your policies and procedures against the CSF and report where they fall short. That is an assessment of your documents, not authorship of them. Ask the firm to confirm in writing that the consulting output is a findings report, and that drafting replacement policies is handled by your team or another party. Keep the findings and the validated assessment on separate engagements with separate engagement executives where the 12-month rule applies.
Penetration testing
Testing your systems is a permitted service, and the assessor's own technical testing can feed the validated assessment. The risk is overlap: if the same team later decides which findings count as remediated, the independence question returns. Confirm who scopes the test, who receives the report, and whether retest work after fixes is performed by the validating team or a separate one.
Vulnerability scanning
Scanning is a recurring technical activity the assessor may perform for the same entity. Its output is evidence of configuration and vulnerability state, so the question is whether your team or the assessor runs the scans, and who owns the remediation tickets that follow. Ask for the scan schedule, the tooling and the retention of raw results before agreeing scope.
Readiness and gap assessments
A gap assessment that tells you which requirements are not yet met is permitted, and it is the most common support the assessor provides before fieldwork. It must stop at identifying gaps. Once the assessor describes how to close a gap in detail, or starts closing it, it moves toward remediation. Ask for the gap report format and confirm the assessor will not use it to design your controls.
Excluded: writing policies and operating controls
Remediation is off limits for assessor staff on your validated assessment. That covers writing your policies, implementing your controls and operating them for you. These tasks belong to your organization, or to an implementation partner that is separate from the assessor. Before signing, ask the assessor to list the activities it will not perform, and check that your readiness partner is not the same firm validating the work.
The 12-month bar: when assessor staff who built controls must step aside
The rule is simple to state: if people in the External Assessor firm helped implement or operate your controls in the prior 12 months, they may not work on your validated assessment. HITRUST then requires a separate assessor team, run under a separate engagement executive, so that the people testing your controls are not the people who built or ran them. This applies to the assessor firm as a whole, not just the individuals who did the work, so the question is about who was on your side of the table, not only who signs the report.
To check this before you sign, ask the proposed assessor for a named roster of every person who will touch your validated assessment, then ask each one three things: whether they worked on your controls, when, and under which engagement. Work through the answers as a list. Any person who implemented, configured, operated or ran a control for you in the last 12 months needs to be moved off your team. Ask for the engagement executive's name too, and confirm that this person did not work on the readiness or remediation engagement. Also ask whether the same firm holds an earlier engagement that touched the same controls, since a shared engagement executive is a common way the separation fails.
Get the answers in writing and keep them in your due diligence file, because HITRUST places the duty to check suitability on the assessed entity, not on HITRUST. If the assessor's staffing changes after contract signature, treat that as a new check and repeat the roster review. Confirm the current rule against the Handbook text linked here, since the exact wording of independence requirements governs and this summary does not replace it.
Which readiness arrangements keep the validated assessment independent
When the External Assessor firm performs only a readiness or gap assessment for your organization, the Handbook treats that work as permitted for the same entity whose validated assessment it will later test. The assessor identifies where requirements are not yet met, but it does not fix them. The independence question is whether the same staff who found the gaps then sit on the validated assessment, and whether the findings are reported to management without the assessor deciding the remediation.
- Permitted activity: Staff on a validated assessment may still provide readiness or gap assessments to the same entity.
- Testing reliance: The gap work is not itself a validated assessment. It cannot substitute for the validated testing HITRUST requires.
- Independence risk: Gap findings that become a to-do list the assessor then checks against its own recommendations can blur the line.
- Staffing rule: Assessor staff who implement or operate your controls in the prior 12 months may not work on the validated assessment.
- Scope control: Management cannot restrict the testing the assessor decides is required, even after a gap assessment.
Before signing, confirm in writing which team performs the gap work, whether any of its members will be on the validated engagement, and how the assessor records the difference between findings and remediation.
Policy and procedure consulting is one of the services the Handbook allows assessor staff to provide to the same entity. The line is drawn at remediation. A firm may review your policies and assess whether they are adequate, but writing the policies themselves moves the firm into owning part of the control environment it is then asked to test. That is the point where the validated assessment loses its independence, regardless of how carefully the team is separated.
- Permitted activity: Reviewing policy and procedure content as a consulting assessment is allowed.
- Prohibited activity: Writing the entity's policies, and implementing or operating its controls, is remediation the assessor may not provide.
- Independence risk: If the assessor drafts a policy and then tests whether the entity follows it, the firm is effectively testing its own work.
- Evidence trail: Ask who authored each policy in your evidence set. Authorship by the assessor is a finding in waiting.
- Separate teams: Even where consulting and validated work are split between teams, the firm-level prohibition on remediation still applies.
Ask the firm to state which documents it has drafted for you, if any, and to confirm that your own staff own each policy in your management system.
A readiness party that is not the External Assessor can help you prepare, provided it is a different legal entity with a different team. The Handbook requires the External Assessor firm to be separate from the assessed entity and independent of the functions it tests. An implementation partner, consultant or readiness licensee sits outside the assessment engagement, so it can help you build and evidence controls. Its role is preparation. It does not give the External Assessor's testing any standing it lacks on its own.
- Permitted role: A readiness licensee or implementation partner can prepare systems, controls and evidence for you.
- Reliance rule: An outside party testing on management's behalf can be relied on only if it is an Authorized External Assessor, holds a HITRUST readiness license for that engagement, or works as an agent of management.
- Independence risk: If the implementation partner later becomes the validated assessor, or shares staff with it, the independence rules apply in full.
- Responsibility split: The partner advises or implements. Your organization owns the controls, and only the External Assessor performs the validated assessment.
- Quote terms: Ask whether the readiness work is under a licence for this engagement and which named staff perform it.
Confirm the partner's licence status for your engagement and make sure the External Assessor has no reporting or staffing link to it.
Staff augmentation places outside people inside your team, working under your direction. The Handbook accepts testing by an outside party as relied-on work when that party acts as an agent of management. That status depends on the reality of the arrangement. The individuals take instructions from your managers, sit in your reporting line, and do not decide the scope or outcome of the validated assessment. If they behave as an independent tester, they fall outside the agent category.
- Permitted role: Augmented staff can perform management testing and build evidence as agents of management.
- Reporting line: Augmented staff should report to your managers, not to the External Assessor or to the team that will assess your controls.
- Independence risk: Staff who also appear on the validated assessment, or who implemented the controls within the prior 12 months, create the conflict the Handbook prohibits.
- Documentation: Keep contracts, role descriptions and reporting lines that show the agent relationship.
- Assessor discretion: Management still cannot restrict the testing the External Assessor decides is required.
Ask the augmentation provider to confirm in writing whether its staff are acting as your agents, and check that the External Assessor has reviewed that arrangement before fieldwork starts.
How to run due diligence before engaging a HITRUST External Assessor
This sequence lets you confirm the firm's standing, the independence of every proposed person, and the division between readiness and validation before you sign, and it leaves a dated record for each check.
Confirm the firm is an Authorized External Assessor
Check the firm against HITRUST's Find an External Assessor directory, which lists organizations authorized to perform validated assessments and readiness licensees. Confirm the exact legal entity name, not a trading name or a sister company, because HITRUST requires the assessor to be a separate legal entity from your organization. Save a dated screenshot or printout of the directory entry and the firm's written confirmation of its authorization. The step is done when the legal name on the contract matches the directory entry.
Map prior work of every proposed person
Ask the firm for a named list of every person who will work on your validated assessment, including reviewers and the engagement executive. For each person, record every role they have held on your environment, such as implementing, operating, administering or advising on your controls, and the dates of that work. Compare the list against your own project records and your vendors' records to catch anyone who touched your controls. The output is a signed staffing map showing whether anyone worked on your controls in the prior 12 months.
Request a written independence statement
Ask the firm for a signed independence statement covering the prior 12 months that addresses the assessor's separate legal status, the absence of overlap in staffing, control ownership and reporting lines, and the absence of remediation work for your organization. Ask the firm to state which readiness, gap, penetration testing or policy consulting services it has provided to you, and when. Compare that list with the work you have commissioned from any other party. The step is done when the statement is signed by a person with authority at the firm and the list of prior services is complete.
Confirm the separate engagement executive
HITRUST requires a validated assessment staffed by a team separate from anyone who implemented or operated your controls in the prior 12 months, with a separate engagement executive. Ask the firm to name that executive and show that this person was not part of any readiness, remediation or control operation work for your organization. Confirm that the executive has no reporting line to the team that prepared your evidence. The output is a written confirmation naming the executive, with the check recorded in the file.
Confirm who performs readiness and under which engagement
Decide which services you want from the firm and confirm that each one sits under a separate, documented engagement. Permitted services for validated assessment staff include gap assessments, policy and procedure consulting assessments, penetration testing and vulnerability scanning, but writing your policies or implementing or operating your controls is excluded. If a party other than the assessor will prepare you for the assessment, confirm in writing that it is an agent of management, a readiness licensee for that engagement, or an Authorized External Assessor. The output is a table of services, providers and engagement letters.
Confirm management will not restrict assessor testing
Ask the firm to confirm in writing that the scope, nature and extent of testing will be set by the assessor and not limited by your management. Record any constraints you plan to place on access, sampling or interviews, and confirm they are compatible with the assessor's decisions. The step is done when the scope letter states that testing decisions rest with the assessor.
File the diligence record and accept the residual risk
Compile the directory evidence, staffing map, independence statement, executive confirmation, service table and scope letter into one dated file, signed by your accountable executive. HITRUST states it cannot guarantee that any External Assessor will succeed on a specific engagement, so this record documents your own due diligence duty rather than a promise of outcome. Schedule a review of the file if staffing, services or the engagement changes before fieldwork begins. The output is a signed diligence file ready for audit.
What buyers ask about assessor conflicts and readiness scope
Can the same firm do our HITRUST readiness work and also validate our assessment?
Often not with the same team, and never without a clear split. HITRUST requires the External Assessor firm to be a separate legal entity from the organization being assessed, and the assessor function must be independent of the functions it tests, with no overlap in responsibilities, staffing, control ownership or reporting. Assessor staff on a validated assessment may still provide readiness or gap assessments, policy consulting and penetration testing to the same entity, but they may not write your policies or implement or operate your controls. Ask the firm to show you how it separates the two engagements before you sign.
What happens if the consultant who built our controls later becomes our assessor?
The consultant is restricted for a period after the build. Assessor staff who were involved in implementing or operating your controls in the prior 12 months may not work on your validated assessment. In that case a separate team, led by a separate engagement executive, must perform the validation. Confirm the start date of the 12-month window with the firm in writing, since a change of staff or a change of firm does not reset the rule on its own. If the firm you chose for readiness cannot staff a clean team, choose a different External Assessor now rather than during fieldwork.
Can our internal team prepare the evidence for a HITRUST assessment?
Yes, your team owns the controls and is expected to produce and organize the evidence. HITRUST assigns the assessed entity responsibility for its own controls and for its own due diligence. What is restricted is who may write or operate the controls on the assessor's side. Your staff can gather logs, policies, access reviews and tickets, and an implementation partner can help structure them. Make sure the evidence reflects what your staff actually did, because the External Assessor must test it independently and will not accept documents written for the audit alone.
What does a conflict of interest look like in practice?
A conflict arises when the same people design, operate and then judge the same controls. Common examples include an assessor firm whose staff wrote your information security policies, configured your access management or ran your monitoring, then tested those same items during validation. Another is management restricting what the assessor may examine. HITRUST does not allow management to limit the nature, scope or extent of testing the assessor decides is required. Note that an outside party testing for management can only be relied on if it is an Authorized External Assessor, holds a HITRUST readiness license for that engagement, or works as management's agent, such as staff augmentation.
Does a readiness engagement make a passing HITRUST result more likely?
A readiness engagement can improve preparation, but it does not guarantee a result. HITRUST states that it cannot guarantee any External Assessor will succeed on a specific engagement, and the assessed entity must perform its own due diligence before engaging one. Readiness work can find gaps, test evidence and rehearse sampling, which reduces surprises during fieldwork. Ask any firm for a clear description of what the readiness review covers, what it does not cover, and how findings are handed to your team to close.
What should we get in writing before engaging a firm for readiness and validation?
Get the separation of duties in a signed document, not a sales conversation. Ask for the names and roles of each team, the date the independence window started, and confirmation that no assessor staff member has built or operated your controls in the prior 12 months. Require a written statement of what the readiness engagement excludes, such as remediation or implementation, and confirmation of the firm's Authorized External Assessor status and its readiness licensing where relevant. Ask how the firm will handle a conflict that appears mid-engagement, and whether a separate engagement executive will be assigned.
Who owns the controls, the readiness work and the report
The organization owns its controls, its evidence and the decision to pursue HITRUST. It operates the policies, configurations and processes that the assessment tests, and it decides whether to engage an External Assessor and when. HITRUST places responsibility for due diligence on the assessed entity before it signs with any External Assessor, and it states that HITRUST cannot guarantee that any External Assessor will succeed on a given engagement. Before signing, ask the assessor to show its Authorized External Assessor status and to explain, in writing, which of your staff it will interview and which systems it will test.
An implementation partner or readiness licensee prepares the systems and the evidence. That work covers gap analysis, scoping, control design support, configuration hardening, evidence collection and remediation planning. The partner works for management and does not sign or issue anything on HITRUST's behalf. Where a partner tests controls on management's behalf, HITRUST allows that testing to be relied on only if the party is an Authorized External Assessor, holds a HITRUST readiness license for the engagement, or acts as an agent of management such as through staff augmentation. Confirm which of these applies before you accept a partner's test results as input to the validated assessment.
Only the authorized External Assessor performs the validated assessment. Its fieldwork tests the controls itself and it decides the nature and extent of testing, which management may not restrict. HITRUST then performs central quality assurance on the submitted assessment before it issues any report or certification. A partner's readiness report, a policy set or a consultant's sign-off does not certify anything. When a customer asks for proof of HITRUST status, the document to request is the HITRUST-issued report or certification, not a letter from a consultant.
How the validated assessment sequence runs once independence is confirmed
Once independence is confirmed, the sequence moves from engagement and scoping through readiness, a fieldwork window of at most 90 days, and reporting under HITRUST quality assurance, with a defined output at each phase. Each phase has a clear owner, so you can see what the assessor will test and what you must have ready.
Confirm independence and sign the engagement
Before any work starts, your team confirms in writing that the External Assessor firm is a separate legal entity, that its staff did not implement or operate your controls in the prior 12 months, and that the readiness work and validated assessment are staffed and led by different people under different engagement executives. Your legal, security and procurement leads own this check. The output is a signed engagement letter, a documented independence record and a named engagement executive on each side.
Agree the assessment scope and assessment type
The assessor and your team agree which assessment type applies (e1, i1 or r2), which systems, facilities and business units fall in scope, and which inherited or carved-out services are covered. Your security lead owns the scope decision, and the assessor decides the testing it requires, because management cannot restrict the nature, scope or extent of testing. The output is a written scope statement that both parties sign off on.
Complete readiness work with a separate team
Readiness and gap work, along with any policy consulting, is performed by a team that is independent of the validated assessment, which is the only set of activities an assessor staff member may provide to the same entity. Your internal owners or an implementation partner close gaps, and remediation such as writing policies or operating controls is kept outside the assessor's team. The output is a gap list showing which requirements are met, which are being remediated and which evidence is still missing.
Assemble evidence and walk the assessor through it
Your control owners gather the evidence for each in-scope requirement and confirm that the evidence is current and attributable to the period under review. The assessor reviews a sample of this material before fieldwork begins, so gaps surface early. The output is an evidence index mapped to requirement statements, with each item owned by a named person in your organization.
Run validated assessment fieldwork within 90 days
The assessor performs its validated assessment fieldwork in a window of at most 90 days, testing controls, reviewing evidence, interviewing staff and performing any technical testing it deems necessary. Your team answers requests, provides access and logs open questions in one tracker. The output is a set of documented testing results and findings, scored against each requirement statement.
Resolve findings and document corrective actions
Where fieldwork identifies gaps, your team proposes remediation, the assessor reviews whether the fix is in place and evidenced, and any remaining gaps are recorded for corrective action planning. Remediation is owned by your organization, and the assessor does not design the fix. The output is a closed findings log and any corrective action plans that the assessor has reviewed.
Issue the report and pass HITRUST quality assurance
The External Assessor completes its validated assessment report and submits it to HITRUST, which performs central quality assurance before any report is issued. Your team should confirm the report submission and QA status with the assessor and HITRUST, and should not treat the assessor's own internal sign-off as final. The output is the HITRUST-issued report and, where the assessment passes, the certification, which you then use with your customers and regulators.
What to have in place before the assessor starts fieldwork
Fieldwork goes faster and stays defensible when the assessor can see who did what, where the boundary sits and which evidence already exists. The cards below cover the records to gather before the assessor arrives, and each one explains how to check that the record holds up.
Independence documentation on file
Keep a written record showing the External Assessor firm is a separate legal entity from your organization and that no staff member has overlapped with your control ownership, staffing or reporting lines. Ask the assessor to confirm in writing which of its staff touched your environment in the prior 12 months, and compare that list against your own change and access records. A gap in either direction should be resolved before fieldwork begins, not during it.
Written assessment scope
Document the systems, facilities, business units and third parties inside the assessment boundary, and the reasons any item sits outside it. The assessor decides how much testing is required, and your management cannot narrow that testing, so the scope document should describe your environment accurately rather than try to limit the work. Have the owner of each system sign off on it.
Roster of control contributors and dates
List each person who implemented or operated a control in scope, the controls they worked on and the dates they did it. This roster drives the independence decision: anyone who built or ran a control in the prior 12 months cannot sit on the validated assessment team. Keep the list current as people change roles, and note which contributors belong to a readiness partner rather than your staff.
Evidence packaged for testing
Assemble the artifacts that show each control operated, such as approved policies, access reviews, change tickets, scan results and incident records, and store them in a location the assessor can reach. Confirm the dates on each item fall inside the period under review. Evidence produced by a readiness partner is acceptable only when the assessor can see who produced it and that it reflects your own operation.
Named internal control owner
Name one person inside your organization who answers assessor questions, approves evidence requests and decides on scope disputes. This person must be someone who does not run the controls being tested, so their answers carry weight with the assessor. Confirm the name and contact details with the assessor during kickoff, and record any change in writing.
How DeployOpen works on this
DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside your own infrastructure. We prepare systems, controls and evidence for your HITRUST readiness work, while the independent External Assessor performs and reports the validated assessment.
How we scope
- Engagements are fixed-scope, with the in-scope HITRUST domains and deliverables agreed in writing before work starts.
- The written scope states which parts of readiness we do and which parts stay with your team or your assessor.
- Scope also records who owns each control, so ownership is never shared with the assessor's validated testing team.
How we build
- We configure and document the open-source platforms and controls that your own staff will operate after handover.
- Evidence outputs such as logs, access reviews and configuration records are designed to be retrievable and dated for the assessor.
- Testing we run on your environment is reported to you as readiness findings, not as validated assessment results.
How we hand over
- You receive documentation of configurations, control ownership and evidence locations so your team can answer assessor requests.
- Your staff or your assessor decide what to accept, and we do not write policies or operate controls for the validated assessment.
- Handover records show who ran each step, so your due diligence file can show the separation between readiness and assessment.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the fixed-scope work ends.
- Confirm with your assessor, in writing, which readiness activities they will accept as independent of their own work.
- Ask us for a written scope and quote that names the HITRUST assessment type and your intended assessment window.
