What does the HITRUST CCSFP certification cost and who needs it?
When a customer or contract requires HITRUST, the first staffing question is which of your people need the Certified CSF Practitioner (CCSFP) credential. The HITRUST CCSFP course costs $3,300 including one exam attempt as of January 1, 2026, and it earns 27 CPE credits. The course combines HITRUST Academy pre-work, live virtual sessions and an exam, so budget for the time it takes as well as the fee. Confirm the current price on the HITRUST CCSFP page before you commit budget, because the figure is dated.
The real requirement depends on where the person sits. Staff inside an External Assessor firm face the strictest rules: the engagement executive, fieldwork lead and engagement QA reviewer on a validated assessment must hold the CCSFP, and at least half of validated assessment engagement hours must be performed by CCSFP holders. Staff on a readiness team or in an internal assessor function have different obligations, and the first question to ask is whether your internal testing will ever be relied on by the External Assessor, which requires CCSFP holders performing those testing hours. Ask each candidate which function they will work in before you enroll anyone.
Remember the division of roles. Your organization owns its controls, a readiness partner helps prepare systems and evidence, and only the External Assessor validates the assessment and HITRUST issues the report. A CCSFP on your payroll does not make your team an assessor, and a CCSFP on a partner's team does not replace the independent validation. Ask any firm you hire to state in writing which of its people hold the credential and which role each will play.
What a CCSFP costs the person and the firm
This table lists each cost tied to the Certified CSF Practitioner credential, who usually pays it, and whether it is one-time or recurring. Prices are as of January 1, 2026, as stated on HITRUST's CCSFP page, so confirm current figures there before budgeting. The main takeaway is that the initial course is a one-time cost, while refreshers and retakes recur and fall to whoever holds the credential.
| Cost component | Amount (as of January 1, 2026) | One-time or recurring | Who usually pays |
|---|---|---|---|
| Initial CCSFP course | $3,300, including one exam attempt | One-time | Individual or employer, often the assessor firm |
| Pre-work and live virtual sessions | Staff hours, no HITRUST fee listed in the course price | One-time | Employer, through staff time |
| Annual self-paced refresher | $1,365, 4 CPE credits | Recurring each year | Individual or employer |
| Exam retake | $550 per attempt | Only if a retake is needed | Individual or employer |
| Full course retake after two years of refreshers | Course fee applies again, confirm current price | Recurring every two years | Individual or employer |
| Staff time for annual refresher | Hours set by the individual's workload | Recurring each year | Employer, as billable or overhead time |
| Assessor firm staffing | Firms must employ at least 5 CCSFPs and 2 CHQPs at all times | Ongoing headcount | Assessor firm, reflected in its fees |
Which CCSFP staffing rules apply to External Assessor firms
An External Assessor firm must staff its validated assessments with people who hold HITRUST credentials at several levels of the engagement. The four rules below work together, so a buyer checking an assessor's bench should test each one separately and ask for named people, not a headcount alone.
Firm-wide bench minimums
An External Assessor firm must employ at least 5 CCSFPs and 2 CHQPs at all times, not only during the engagement you are buying. Because the requirement is continuous, a firm that lost staff after a previous assessment may not meet it today. Ask for the current count of active CCSFP and CHQP holders, and confirm that the people counted are employees rather than contractors whose availability can change between engagements.
Named roles held by CCSFPs
The engagement executive, the fieldwork lead and the engagement QA reviewer on a validated assessment must each hold the CCSFP. These three people carry responsibility for the assessment's direction, the testing performed and the quality check before results are reported. Ask for their names and certificate status at the proposal stage, since a substitution later in the engagement can disrupt the fieldwork window.
Half of hours by CCSFPs
At least 50% of validated assessment engagement hours must be performed by CCSFPs. This rule concerns effort, not job titles, so a senior CCSFP who signs off on work done by uncredentialed staff does not satisfy it alone. Ask the assessor to show how hours are split across its team in the proposed plan, and confirm that the hours billed to you match the people doing the testing.
Pre-submission quality reviewer
Before a validated assessment is submitted, the External Assessor's own quality reviewer must review it, and that reviewer must hold both the CCSFP and CHQP designations. This internal review sits in addition to HITRUST's central quality assurance, which happens after submission. Ask who the reviewer is, whether that person is independent of the fieldwork team, and how many findings were returned to the team in prior engagements.
Checking the bench before signing
Verify the rules against HITRUST's published list of authorized External Assessor organizations before you rely on any firm's claims. Confirm that the names on the proposal match the people who will do the work, and put the staffing commitments in the contract so a change requires your approval. The CCSFP holder's status can be checked, so ask the assessor to confirm each person's current designation in writing.
Why internal assessors need every tester to hold a CCSFP
An External Assessor can rely on testing performed by the entity's internal assessor function only when several conditions hold at once. HITRUST must have approved the function, the function must be objective, all of its testing hours must be performed by CCSFP holders, the evidence it tests must be no more than 90 days old, and its work must meet HITRUST's testing and documentation rules. The CCSFP condition is the one teams most often underestimate, so plan staffing around it before any testing begins.
The all-CCSFP condition is strict. It applies to the function's testing hours, not to a percentage of its staff, so a single non-certified tester who performs testing hours can affect whether the External Assessor may rely on the function's work. Treat this as a staffing rule to verify, not a preference. Before you assign work, confirm the credential status of every person who will test, including contractors, seconded staff and staff from other business units who may be asked to help during a busy fieldwork period. Ask your internal audit or assessment lead to keep a current roster that shows each tester's CCSFP status and the date it was last confirmed.
Confirm the exact reliance terms with your External Assessor early, in writing, and with HITRUST's current Assessment Handbook in hand. The reperformance rules and the objectivity expectations that govern how internal testing is sampled and documented are covered in the internal assessors topic, so review that guidance before you design the function. If you cannot confirm that every tester qualifies, plan for the External Assessor to test those requirements directly rather than rely on your team's work.
How a CCSFP is earned and kept current
The sequence moves a staff member from course enrollment to a credential that is then renewed through annual refreshers, which keeps the holder eligible for the staffing roles HITRUST sets for assessor firms and internal assessor functions. Each stage produces a record that an employer or assessor can check.
Enroll in the CCSFP course
The candidate registers for HITRUST's Certified CSF Practitioner course, which costs $3,300 including one exam attempt as of January 1, 2026 (HITRUST CCSFP page). The fee is paid to HITRUST by the individual or the employer, and it is a one-time cost for the initial credential. Ask the employer to confirm whether the fee covers only one exam attempt and who pays for a retake. The output of this step is an active course enrollment linked to the candidate's HITRUST account.
Complete HITRUST Academy pre-work
Before the live sessions, the candidate completes the HITRUST Academy pre-work that the course combines with virtual instruction. The pre-work covers the CSF structure and the assessment concepts the live sessions build on. Completion is recorded in the candidate's course history, and the candidate should confirm with HITRUST which pre-work modules must be finished before the live sessions start.
Attend the live virtual sessions
The candidate attends the live virtual sessions that make up the core of the course. The sessions walk through the CSF requirements and how validated assessment testing is performed and documented. Attendance is tracked by HITRUST. The course as a whole earns 27 CPE credits, which the candidate should record in their continuing professional education log.
Pass the CCSFP exam
The candidate sits the CCSFP exam, which is included in the course fee for one attempt. A pass earns the Certified CSF Practitioner designation, and the holder can then be counted toward the CCSFP staffing requirements for External Assessor firms and internal assessor functions. A failed attempt requires a retake, which costs $550 (HITRUST CCSFP page). The output is a CCSFP designation in the holder's HITRUST record.
Complete the annual refresher
Each year the holder completes HITRUST's self-paced refresher course, which costs $1,365 as of January 1, 2026 and earns 4 CPE credits (HITRUST CCSFP page). The holder or employer pays this recurring fee. Completion keeps the CCSFP designation current, and the holder should file the completion record with the 4 CPE credits in their continuing education log before the next annual cycle.
Repeat refreshers for two years
The holder continues the annual refresher cycle. The designation is kept through refreshers for two years, after which HITRUST requires the full course to be retaken. Organizations should track each CCSFP's refresher dates in a staffing register so that the firm or internal assessor function can show that every holder is current when HITRUST or an assessment reviewer checks staffing.
Retake the full course after two years
After two years of refreshers, the holder must retake the full CCSFP course, including pre-work, live sessions and the exam, and pay the course fee again. The new completion record and exam result replace the prior cycle in the holder's HITRUST record. Confirm with HITRUST the current course fee and the exact timing of the retake before scheduling it, since the fees quoted apply as of January 1, 2026.
Who should hold the credential and who can wait
Authorized HITRUST External Assessor firms carry the strictest staffing rules. HITRUST requires a firm to employ at least a minimum number of CCSFP holders and CHQP holders at all times, and the people who run a validated assessment must hold the credential. For a validated assessment, this means the engagement executive, the fieldwork lead and the engagement QA reviewer must each be CCSFPs. The firm's own quality reviewer must hold both the CCSFP and the CHQP before submission. At least half of the engagement hours must also be performed by CCSFPs.
- Engagement executive: must hold the CCSFP for each validated assessment the firm runs.
- Fieldwork lead and engagement QA reviewer: must hold the CCSFP on every validated engagement.
- Firm quality reviewer: must hold both the CCSFP and the CHQP, reviewing the assessment before submission.
- Hours mix: at least 50% of validated assessment hours must be worked by CCSFPs, so other staff can contribute only within that limit.
- Firm headcount: the firm must keep the required number of CCSFPs and CHQPs on staff at all times, not only during one engagement.
Before you sign with a firm, ask for the names and credential status of the people who will fill each of these roles, and confirm them against HITRUST's published lists.
An internal assessor function, such as an internal audit team or a facilitated testing group, can produce testing an External Assessor relies on, but only if HITRUST has approved that function. The CCSFP is a condition of that reliance rather than an optional upgrade. Every hour of testing the function performs must be done by a CCSFP holder, and the work must meet HITRUST's testing and documentation rules.
- Approval first: the function must be approved by HITRUST before its testing counts toward a validated assessment.
- Full CCSFP staffing: all testing hours in the function must be performed by CCSFP holders, so a single untrained tester can affect reliance on the whole body of work.
- Objectivity: testers must be independent of the controls they test, which often rules out staff who run those controls.
- Evidence age: evidence the External Assessor relies on must be no more than 90 days old.
- Documentation: testing must be documented to the standard the External Assessor will need to review.
Ask your External Assessor how it intends to use internal testing and whether your function's current approval and staffing meet that plan before fieldwork is booked.
Internal compliance, security and IT staff who gather policies, configurations, logs and tickets usually do not need the CCSFP to prepare for a HITRUST assessment. Their work is evidence production and coordination. The CCSFP becomes a practical advantage for people who will own readiness planning, interpret requirement statements and talk with assessors about scoping, sampling and N/A decisions, because those conversations go better when the reader already understands how assessors test.
- Evidence owners: system administrators and engineers who produce screenshots, exports and configuration records typically need training on evidence rules, not the credential.
- Program leads: a compliance lead who coordinates readiness and decides scope benefits from the CCSFP because the decisions shape the assessment.
- Internal assessor staff: anyone who tests inside an approved function needs the CCSFP, as the previous tab explains.
- Cost to weigh: the course and refresher fees are paid by the individual or employer and recur through the refresher cycle, so limit enrollment to roles that use the knowledge.
- Limit of the credential: the CCSFP does not authorize an employee to validate their own organization's assessment.
Confirm current course fees and CPE requirements directly with HITRUST before budgeting, since they change.
Implementation partner engineers build, configure and document systems that support HITRUST controls. The CCSFP is unnecessary for this work, and a partner should not test its own deliverables as though it were the assessor. The independence boundary is the line that matters: the partner prepares systems, controls and evidence, while the External Assessor tests them and the organization owns the result. A partner that holds the credential still cannot act as the assessor for the same engagement.
- Build work: configuring platforms, hardening systems and writing procedures does not require the CCSFP.
- No assessor role: partner engineers must not perform the testing, sign off on requirement statements or issue conclusions about the assessed environment.
- Evidence preparation: a partner can organize and explain evidence so the organization can present it, but it should not create or alter records to pass a test.
- Independence: a partner that helped design a control should not be the party that tests it for a validated assessment.
- Written scope: the division of work should be stated in the engagement scope so that no one assumes the partner is performing an assessor's role.
Ask any partner to state in writing which tasks it will perform, which tasks belong to the organization and which belong to the External Assessor.
What to check before you rely on a firm's CCSFP staff
A firm's CCSFP staffing decides whether its validated assessment can be submitted and whether its testing carries weight. The checks below move from the firm's standing, to the named people, to the hours they actually work, and finally to how long they stay on your engagement.
Confirm authorized External Assessor status
Only Authorized HITRUST External Assessor organizations may perform validated assessments submitted for certification. Check the firm's name against HITRUST's Find an External Assessor listing before you discuss scope or price, and note whether the listing covers the assessment type you need (e1, i1 or r2). A firm that offers readiness help but is not on the list can still be useful for preparation, but it cannot validate your assessment.
Get named engagement roles
Ask the firm to name the engagement executive, the fieldwork lead and the engagement QA reviewer for your assessment. Each of these roles must hold the CCSFP designation. Request each person's name and designation in writing, and ask which of them will sign the work. Vague answers such as "our certified team" do not let you check anything.
Test the 50% hours rule
At least half of validated assessment engagement hours must be performed by CCSFP holders. Ask for the proposed team with planned hours per person and designation, then add up the CCSFP share. If a large block of fieldwork sits with non-certified staff, ask how the firm will reassign it. Confirm that this split is written into the proposal, not just stated in the sales conversation.
Verify designations with HITRUST
A certificate copy or a badge on a résumé is a claim, not proof. Ask the firm to confirm each person's CCSFP status and, for the quality reviewer, CHQP status, and check those statuses through HITRUST directly. Designations lapse if refresher training is not completed, so a credential that was valid last year may not be valid during your fieldwork window.
Confirm continuity across the cycle
Ask which people will stay on the engagement from readiness through fieldwork, submission and any later interim or renewal work. Staff turnover mid-engagement can break the reviewer's familiarity with your evidence and can leave a designation unverified at the next cycle. Ask for a written commitment on key roles, along with the process for replacing a named person and whether the replacement must meet the same designation requirements.
What happens when a CCSFP lapses mid-engagement
A CCSFP who lapses during a validated assessment can put the whole engagement at risk, because the External Assessor's staffing rules are tested against the people actually doing the work. An External Assessor firm must employ at least 5 CCSFPs and 2 CHQPs at all times, the engagement executive, fieldwork lead and engagement QA reviewer on a validated assessment must hold the CCSFP, and at least 50% of engagement hours must be performed by CCSFPs. If one or two key people lose their designation, the firm may fall below the firm-level minimum, or the hours share may shift against the rule, and the validated assessment can stall until the firm restaffs. Lapses are most likely to matter when the firm is small, when one person holds several of the required roles, or when a refresher deadline falls close to fieldwork.
Because a lapse can stop work, the buyer's useful question is not whether the firm currently meets the minimums but how it keeps meeting them. Ask how many CCSFPs and CHQPs the firm employs today and how many of them would be free to step into the engagement executive, fieldwork lead or QA reviewer roles on short notice. Ask who on the proposed team holds more than one required role, and what the firm would do if that person left or lapsed. Ask how the firm tracks the annual refresher and the two-year cycle for each holder, who owns that calendar, and whether the firm checks designation status before fieldwork is scheduled, not after.
Confirm the answers in writing before signing. Ask the firm to name the replacement plan for each required role and to say whether a replacement's designation is current, since a newly added person must also meet the rules before counting toward them. Check the current holders' designation status against HITRUST's own directory of External Assessors and practitioners, and ask how the timeline would change if a lapse happened inside the 90-day fieldwork window. Record these commitments in the statement of work so that staffing risk, and who carries the cost of a delay, is agreed before work starts.
CCSFP questions buyers and practitioners ask
Does my HITRUST assessor firm need CCSFP staff?
Yes, but the requirement sits on specific roles and hours rather than on every person in the firm. An External Assessor firm must employ at least 5 CCSFPs and 2 CHQPs at all times. On a validated assessment, the engagement executive, the fieldwork lead and the engagement QA reviewer must each hold the CCSFP. The firm's own quality reviewer must hold both the CCSFP and CHQP designations before the assessment is submitted. Ask any firm you shortlist for its current CCSFP and CHQP headcount and for the names filling each required role. The HITRUST Assessment Handbook sets out these staffing rules.
Can a HITRUST readiness consultant help without a CCSFP?
The staffing rules you can verify apply to External Assessor firms and the validated assessment they submit, so they do not by themselves set a credential for readiness help. Readiness work, policy drafting and control build-out sit outside the validated assessment. A missing credential is still a question to ask, though. Ask the partner which people will do the work, what HITRUST authorization the firm holds, and whether its staff have CCSFP or other HITRUST training. Confirm with HITRUST whether readiness licensees carry any staffing requirement before you sign. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue HITRUST reports or certifications. An independent External Assessor issues those.
How much does the CCSFP course cost in 2026?
The CCSFP course costs $3,300 as of January 1, 2026, and that price includes one exam attempt. The course combines HITRUST Academy pre-work, live virtual sessions and an exam, and it earns 27 CPE credits. Plan for the course fee, the time needed for pre-work and live sessions, and the cost of any extra exam attempt. HITRUST's CCSFP certification page is the source for these figures and for the current terms. Confirm with HITRUST whether group or volume pricing exists before you budget for several staff members.
How long does a CCSFP stay valid without refreshers?
A CCSFP keeps the designation through an annual self-paced refresher, so the credential depends on taking that refresher each year. The refresher costs $1,365 as of January 1, 2026 and earns 4 CPE credits. HITRUST requires a full retake of the course after two years of refreshers. A practitioner who misses the yearly refresher should expect to need a route back to current status, and the sources supplied do not set out the exact lapse period. Before you plan staffing around a named person, confirm with HITRUST what happens when a refresher is missed, how a lapsed designation can be reinstated and whether any grace period applies.
Can our internal team test HITRUST controls without a CCSFP?
Only under narrow conditions. An External Assessor may rely on testing by the entity's internal assessor function if HITRUST has approved that function, the function is objective, all of its testing hours are performed by CCSFP holders, its evidence is no more than 90 days old and its work meets HITRUST's testing and documentation rules. A team with no CCSFP holders therefore fails the staffing condition for reliance, however skilled its members are. That team can still gather evidence, run control checks and close gaps, and that work supports readiness. If your internal function cannot meet every condition, plan for the External Assessor to test those requirements directly. The Handbook covers the detail.
How much does a CCSFP exam retake cost?
An exam retake costs $550, according to HITRUST's CCSFP page. The $3,300 course price already includes one exam attempt, so a candidate who passes on the first attempt pays no extra exam fee. Budget for a retake if a candidate may not pass the first time, and add the study time for another attempt to your timeline. Confirm the current retake price with HITRUST before you commit, because fees can change and the official page is the authoritative source.
What share of HITRUST assessment hours must CCSFPs perform?
At least 50% of validated assessment engagement hours must be performed by CCSFPs. This sets a minimum share of hours and does not set a headcount. A firm can meet the floor with a small group of CCSFPs who carry most of the testing, or with a larger team in which CCSFPs cover the complex domains. Ask the assessor for a staffing plan that shows how many hours CCSFPs will cover, which domains they will test and who signs off each domain. Because the engagement executive, fieldwork lead and QA reviewer must also hold the designation, the plan should name them.
How DeployOpen works on this
DeployOpen does not issue HITRUST credentials or assessment reports. We help your organization prepare the systems, controls and documented evidence that staff pursuing the CCSFP credential and your internal assessment team will work from, inside your own infrastructure. Independent HITRUST bodies and External Assessors make every formal determination.
How we scope
- We agree a written scope that names the staff roles, assessment work and environments covered before any work starts.
- Scope sets which self-hosted platforms, logging sources and control areas are included in the preparation work.
- Engagements are fixed-scope, with deliverables and timelines confirmed in writing before we begin.
How we build
- We configure self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks to generate evidence.
- We set up documented procedures and evidence collection so internal testers can show what was tested, when and by whom.
- We run internal test walkthroughs against the agreed scope so gaps are visible before any External Assessor reviews the work.
How we hand over
- You receive configuration records, procedures, evidence indexes and test documentation that your team owns and can maintain.
- We walk your staff and internal assessors through the evidence set so they can explain each control to an assessor.
- Your organization keeps decisions on control ownership, staffing and CCSFP enrollment, and confirms the final package.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover evidence refreshes when HITRUST publishes CSF version updates, which your organization should confirm with HITRUST.
- Questions about which credential, assessor role or independence rule applies should go to HITRUST or your External Assessor.
