HITRUST internal assessor testing: when an assessor can rely on it

When can an HITRUST internal assessor's testing be relied on?

If you want your internal audit team or a facilitated team to test HITRUST requirements before the External Assessor arrives, the assessor may rely on that testing only if HITRUST has approved the internal assessor function, the function is objective, all of its testing hours are performed by CCSFP holders, and its evidence is no more than 90 days old. Meeting those four conditions is the entry point, not the finish line, because the testing must also follow HITRUST's testing and documentation rules. Start by asking whether your internal function has HITRUST approval in writing and whether every person logging testing hours holds a current HITRUST Certified CSF Practitioner credential.

Objectivity is where most internal programs get stuck. HITRUST treats objectivity as absent when the internal assessor function and the function being tested, such as IT operations, report to the same leader. It is also absent when internal assessors helped design, implement or operate the control they are now testing. Map your reporting lines against each in-scope domain before any testing starts, and document who built each control. If the answer is that the team tested its own work, plan for the External Assessor to test that requirement directly or to rely on a different source.

The amount of reliance also depends on how much the External Assessor must reperform. When it relies on internal sample testing, the assessor must reperform at least 20% of the samples and must still lead or take part in walkthroughs of the control environment. Ask your assessor early which samples it will pick, so your team does not spend effort on evidence that will be reperformed anyway. Confirm the current evidence age window, the reperformance expectations and the walkthrough arrangements in writing with your External Assessor before scheduling internal fieldwork, and consider whether an outside party acting as your agent, such as a staff augmentation firm, is a better fit for the tests you cannot staff internally. Details are set out in the HITRUST Assessment Handbook.

What the External Assessor checks before relying on internal testing

An External Assessor can reuse your internal assessor's testing only when five conditions hold together. Each one is a question the assessor will ask you to answer with records, not with assurances, so confirm each before the validated assessment starts.

HITRUST approval of the function

The assessor first needs proof that HITRUST has approved your internal assessor function. Ask the assessor what documentation of that approval it will request and confirm internally that the approval covers the function and the scope you plan to use. Check that the people doing the testing still fall within the approved function, since a change in team or reporting line can leave the approval in doubt. Do not assume an earlier approval carries over to a new assessment cycle without checking the terms.

Objectivity of the testers

Internal testers must be objective, and HITRUST treats objectivity as lost when the internal assessor function and the function under test report to the same leader. The assessor will also ask whether any tester helped design, implement or operate the controls being tested. Confirm the reporting lines on an organization chart, then list every person who touched each control in the past year and remove them from its testing.

All testing hours by CCSFP holders

Every hour of internal testing must be performed by a HITRUST Certified CSF Practitioner. The assessor will request the roster of testers with CCSFP status and the dates each credential was active during the testing period. Confirm that no contractor, temporary staff member or manager who signed off on work is missing from the roster, because a single untrained hour can break reliance on the whole function.

Evidence no more than 90 days old

Evidence used for internal testing must be no more than 90 days old when the External Assessor relies on it. The assessor will ask for the collection date on each sample and for your process for refreshing evidence that ages out during a long fieldwork window. Confirm that your testers record collection dates and that your evidence repository can show the date an artifact was captured, not only the date it was filed.

Testing and documentation rules met

Internal work must follow HITRUST's testing and documentation rules, including how samples are selected, how walkthroughs are recorded and how each conclusion ties to a requirement statement. The assessor will expect a workpaper trail that a reviewer can follow without asking the tester. Confirm that your templates capture the sample population, the selection method, the result and the reviewer's sign-off for every test, and that the External Assessor will reperform at least 20% of the samples and take part in walkthroughs.

Why objectivity fails when reporting lines or design work overlap

HITRUST treats internal testing as unreliable for an External Assessor in two situations, and either one is enough to disqualify it. The first is shared reporting lines: when the internal assessor function and the function being assessed, such as IT, roll up to the same leader, the testing is not considered objective. The second is design overlap: when internal assessors helped design, implement or operate the controls they are testing. In both cases the problem is the same. The person judging whether a control works has a stake in its outcome, and the assessor cannot separate the test from the work it is meant to check.

Consider an illustrative example. A security team administers the identity platform, provisions and removes user access, and also runs the quarterly access reviews that confirm those accesses are appropriate. Its internal assessors then sample the reviews and report that the control works. The External Assessor would not rely on that testing, because the team that operates the access controls is the team evaluating them, and the reviewers are checking their own provisioning. The same result would follow if the security manager who signs off the reviews reports to the same IT director who owns the platform. Neither fact is a finding about the team's competence. They are facts about who holds the decision.

Before relying on internal testing, check each control's owner, administrator, reviewer and reporting chain against these two tests. Confirm that the internal assessors did not configure, approve or perform the control in the assessment period, and that no one on the testing team reports into the function under test. Where the overlap cannot be removed, plan for an independent party to perform that testing, and confirm the exact objectivity criteria with the External Assessor and the HITRUST Assessment Handbook before fieldwork begins.

Which testing models can an External Assessor rely on?

An internal assessor function is a team inside your organization that HITRUST has approved to perform testing the External Assessor can rely on. The function must be objective, and every testing hour must be performed by holders of the HITRUST Certified CSF Practitioner credential. The External Assessor may rely on its sample testing, but it still checks that work before accepting it.

Who performs the testing: Internal assessors inside a function HITRUST has approved, with all testing hours performed by CCSFP holders.
Reliance supported: Sample testing that the External Assessor can rely on, provided it reperforms at least 20% of the samples.
Objectivity: Internal assessors cannot have designed, implemented or operated the controls they test, and the function cannot roll up to the same leader as the function it assesses.
Evidence age: Evidence must be no more than 90 days old when the External Assessor relies on it.
What you still provide: Walkthroughs of the control environment, which the External Assessor must lead or take part in, plus documentation that meets HITRUST's testing rules.

Confirm the approval status of your function with HITRUST and your External Assessor before fieldwork starts.

How the 20% reperformance rule changes the assessor's workload

When an External Assessor relies on sample testing performed by your internal assessor function, the assessor must reperform at least 20% of those samples and must still lead or take part in walkthroughs of the control environment. Reperformance means the assessor selects some of the samples the internal team already tested, pulls the same underlying evidence, and reaches its own conclusion about whether the control operated as described. The assessor does not simply read the internal workpapers and accept the result. Walkthroughs remain the assessor's responsibility, so the internal team cannot substitute its own walkthroughs for that step.

The practical question for your team is how much reperformance the assessor will end up doing. The 20% floor is a minimum. If the internal sample sets are thin, poorly documented, or cannot show that the evidence was complete and dated within the 90-day evidence window, the assessor may need to reperform a larger share of samples or test the control directly. Illustrative example: if an internal team tests a population of access reviews but cannot show how the population was generated, the assessor may decline to rely on those results for that control and run its own sample selection, which adds fieldwork hours inside the validated assessment's fieldwork window of at most 90 days.

Before fieldwork starts, ask your External Assessor which controls it expects to rely on, how it will select the reperformance sample, and what population documentation it needs from your internal team. Then check that the internal samples carry complete population lists, timestamps, and reviewer sign-off so the assessor can reperform quickly. Confirm the reperformance approach with the assessor in writing, because the extra days spent on a weak sample set come out of the same fixed window your evidence must already fit into.

How internal testing fits into the validated assessment

The sequence turns your internal testing into evidence the External Assessor can rely on, with each step producing a documented output that the assessor checks before it accepts the work. Skipping or reordering steps is the most common reason internal testing gets re-done during the validated assessment.

Confirm internal assessor approval and staffing
Before any testing starts, confirm that HITRUST has approved your internal assessor function and that every person logging testing hours holds a CCSFP. Check that the function is objective, meaning its reporting line does not roll up to the same leader as the functions it tests, and that no internal assessor helped design, implement or operate the controls being tested. Ask the External Assessor to review this scope in writing. The output is a signed-off staffing and objectivity record that names each tester and their credential.
Agree the testing plan and sample method
Document which requirement statements the internal function will test, the population each sample is drawn from, how samples are selected and the testing procedures to be followed. Share the plan with the External Assessor so they can confirm it meets HITRUST's testing and documentation rules before fieldwork begins. The output is an approved test plan that defines scope, sampling and evidence types, so that no testing is performed against an undefined population.
Collect evidence dated within the reliance window
Gather evidence for each sample and record the date it was generated or captured. HITRUST limits reliance on internal testing to evidence no more than 90 days old, and the External Assessor's validated fieldwork window is also at most 90 days. Plan collection so that evidence supporting each sample falls inside that window when the assessor uses it. The output is an evidence register that lists each artifact, its source system, its capture date and the control it supports.
Perform internal testing and record results
Internal assessors test each sample against the approved procedures and record the outcome, the reasoning and any exceptions. Exceptions should be logged as they occur rather than adjusted later, and any control that fails testing goes into your corrective action process. Each test should be traceable from the requirement statement to the sample, the evidence and the tester. The output is a completed set of testing workpapers with signed-off results for every sample in the plan.
Hand over workpapers to the External Assessor
Transfer the workpapers, evidence register, test plan and staffing record to the External Assessor in an organized package. Confirm the assessor has access to the underlying evidence so they can select samples and retrieve the artifacts themselves. Agree a single point of contact for questions about the testing. The output is a documented handover that the assessor acknowledges, and that shows which tests they can rely on and which they need to see directly.
Assessor selects and reperforms at least 20% of samples
The External Assessor chooses which internal samples to reperform and must reperform at least 20% of them. Reperformance is done independently, so the assessor should not simply accept internal conclusions. Where reperformance finds differences, the assessor will question the internal work and may expand the sample. The output is the assessor's own reperformance results, which determine how much of the internal testing they accept as reliable.
Complete walkthroughs of the control environment
Even when internal testing is relied upon, the External Assessor must still lead or take part in walkthroughs of the control environment. The walkthroughs confirm that controls operate as the internal testing describes. Plan them with the internal assessors and control owners so the assessor sees the systems and people directly. The output is a set of walkthrough notes that the assessor uses to finalize its testing conclusions for the validated assessment.

Why all testing hours must come from CCSFP holders

Every hour an internal assessor function spends testing HITRUST requirements must be performed by a HITRUST Certified CSF Practitioner (CCSFP). This is a hard condition, not a preference. If even one testing hour on a requirement is logged by someone without the credential, the External Assessor cannot rely on that work as internal assessor testing. Separately, at least 50% of the hours in a validated assessment engagement must be performed by CCSFPs. The two rules are related but different: the first governs the internal function's testing, the second governs the engagement as a whole, including the External Assessor's own team. A facilitated team that mixes credentialed and uncredentialed staff can still be useful for preparation, but its testing hours should be recorded and attributed carefully so that only credentialed hours are presented as reliance-eligible testing.

Before you staff a facilitated team, confirm the rule with the External Assessor that will validate your assessment, and build the roster around it. Ask for each person's CCSFP status, check that it is current in HITRUST's directory of certified practitioners, and keep a dated record of that check in your assessment file. Then map the hours plan against the rule: which testing hours fall to credentialed staff, what share of the total engagement hours they represent, and who will sign off their work. Watch for common gaps, such as a senior reviewer who is not credentialed but performs testing, or a subcontracted contributor added late in the engagement. Each of these can quietly move hours outside the rule. Document any change in staffing as it happens, not at the end of the engagement.

The cost of obtaining or maintaining the CCSFP credential, and the training it requires, are covered on the sibling page on HITRUST CCSFP certification for staff and assessors. This section is limited to the staffing rule and how to verify it. The practical test is simple: for every internal testing hour, can you name the credentialed person who performed it and show their status on the date of testing? If the answer is no for any hour, that hour should not be presented to the External Assessor as internal assessor testing without first discussing its treatment with them.

Where internal testing fits among the four third-party coverage options

HITRUST requires every in-scope third party to be covered by one of four methods. Internal assessor testing is one of them, and it is the only one that depends on your own team's independence and CCSFP staffing, so it carries the most scrutiny from the External Assessor.

Inheriting HITRUST results

Use this when the third party already holds a HITRUST certification that covers the services you rely on. You take the inherited results for the scoped controls and test only what falls outside that scope. The risk is assuming coverage that is narrower than your use: confirm the certified scope, the assessment date and whether the carved-out controls match your data flows before you rely on the certificate.

Relying on third-party audits

Use this when a third party's own audit, such as a SOC 2 report, addresses the requirements in scope. The External Assessor reviews whether that report's scope, period and controls map to the HITRUST requirement. The risk is a period gap or a control the audit excluded, which leaves the requirement unsupported even though a report exists in your file.

Relying on internal assessor testing

Use this when your own internal assessor function tests the third party's controls, for example through an audit of a vendor you manage. The function must be approved by HITRUST, objective, staffed only by CCSFP holders for all testing hours, and working from evidence no more than 90 days old. The risk is losing reliance if your internal team designed or operated the controls, or if its reporting line runs through the function it assesses.

Testing the third party directly

Use this when no certification, report or internal testing covers the party, or when the risk warrants your own examination. Your team or an authorized outside party tests the controls itself and documents the results to HITRUST's testing rules. The risk is cost and effort that recur for every party, and the need for qualified testers, which is why most organizations reserve direct testing for the highest-risk third parties.

Scored not compliant without coverage

If none of the four methods covers an in-scope third party, HITRUST scores the requirement not compliant for that party. This applies even when the third party is otherwise trusted. Before fieldwork, list each in-scope third party, record which method covers it, and confirm the evidence date. Gaps found late in the assessment usually become corrective action items.

Internal testing, facilitated support or external testing: which to pick

This table compares three ways to test HITRUST requirements before the validated assessment: an approved internal assessor function, a facilitated team acting as management's agent, and a licensed outside party. Read each row to see who performs the work, when the option fits, how much reliance the External Assessor can place on it, and what the organization still owns.

Option	Who performs the testing	When it fits	Reliance the External Assessor can give and what you still own
Approved internal assessor function	Your own staff in an internal assessor function that HITRUST has approved, with all testing hours performed by CCSFP holders	Ongoing testing across many requirements where your function is independent of the teams it tests	Sample testing can be relied on if evidence is no more than 90 days old, but the External Assessor must reperform at least 20% of samples and join control walkthroughs. You own objectivity, CCSFP staffing and documentation quality.
Facilitated team or staff augmentation	Individuals working as management's agent, such as contract staff directed by your leadership and not by the assessed teams	Extra hands for preparation work where you need capacity but not an independent test opinion	Work performed as management's agent is treated as management's work. The External Assessor still tests it and does not gain independence from it. You own the direction, the decisions and the evidence collection.
Readiness engagement with a licensed outside party	A party holding a HITRUST readiness license for the engagement, or an Authorized External Assessor	Gap identification and remediation support ahead of a validated assessment	Testing by a licensed readiness party can be relied on for the engagement it covers. Confirm the license terms and scope in writing. You still own the controls, the remediation and the final evidence.
Testing by the External Assessor itself	The Authorized External Assessor performing the validated assessment	Formal validated assessment fieldwork submitted for certification	This is the independent testing that supports certification. Confirm with the assessor which work it may also perform for readiness, since independence rules apply.

What usually stops internal testing from being relied on

An External Assessor can rely on your internal testing only when the function, its people and its evidence all pass HITRUST's tests. The failures below are the ones that most often make that reliance fall away, and each one has a check you can run before fieldwork starts.

Evidence older than 90 days

Internal testing is only usable when the evidence is no more than 90 days old at the point the External Assessor relies on it. Teams often sample a control in month one, then reuse those results after the window closes. Before fieldwork, date-stamp every artifact, record the collection date and re-pull anything that has aged out, such as access reviews or vulnerability scan exports.

Assessors who built the controls

HITRUST treats internal assessors as lacking objectivity when they were involved in designing, implementing or operating the controls they test. A security engineer who configured the logging pipeline cannot test that same pipeline and be relied on for it. Keep a written register of who built or runs each control, and assign testing to people outside that list.

Shared leadership with the tested function

When the internal assessor function and the function under test, such as IT, roll up to the same leader, HITRUST does not treat the testing as objective. This often happens in smaller organizations where one director oversees both. Document the reporting lines on an org chart, and if they converge, move the assessor function to a different leader or to an independent group such as internal audit.

Untracked non-CCSFP hours

All testing hours performed by the internal assessor function must come from staff who hold the HITRUST Certified CSF Practitioner credential. Hours logged by colleagues without it, including those who helped gather evidence or run a walkthrough, can disqualify the work. Keep a timesheet that records each person, their CCSFP status and the hours charged to each requirement, and confirm status with HITRUST before you rely on any hour.

Weak sample documentation

When the External Assessor relies on internal sample testing, it must reperform at least 20% of the samples and still take part in or lead walkthroughs of the control environment. Testing notes that omit the population, selection method, sample size or the exact artifact examined leave the assessor nothing to reperform from. Use a standard test template that captures each of those fields for every sample, and retain the source artifacts with their timestamps.

Common questions about HITRUST internal assessors

Can our own team test HITRUST requirements without outside help?

Your own team can perform testing that an External Assessor relies on, but only when the internal assessor function meets HITRUST's conditions. HITRUST must have approved that function, the function must be objective, every hour of its testing must be performed by CCSFP holders, and its evidence must be no more than 90 days old. The work also has to follow HITRUST's testing and documentation rules. Even then, the organization does not produce the validated assessment itself. An Authorized External Assessor still performs the validated assessment, reperforms a share of the samples, and leads or joins walkthroughs of the control environment. HITRUST performs quality assurance before reports are issued. Treat internal testing as a way to reduce the External Assessor's workload, and keep it separate from the validation itself.

How much effort does an internal assessor function take to run?

The effort depends on how many requirements you test internally, how often evidence is refreshed, and how much documentation each test must carry. Most of the cost is staff time, and it recurs with each assessment cycle, because evidence older than 90 days cannot be relied on and must be collected again. Cost drivers include the number of CCSFP holders on staff, the size of the in-scope environment, how mature the control documentation is, and how many systems share one owner. Your main costs are internal salaries and the training or credentials staff need, and HITRUST fees are separate. Ask your External Assessor and your own leadership for a written plan that covers which requirements the internal function will test, who holds CCSFP credentials, how evidence will be dated and stored, and when walkthroughs will happen. No duration is given here because it depends on your environment, so confirm it with your assessor.

Does a facilitated team or consultant count as internal testing?

Not automatically. A facilitated team counts as reliable testing only if it fits one of the roles HITRUST recognizes for outside parties testing on management's behalf. Those roles are an Authorized External Assessor, a party holding a HITRUST readiness license for the engagement, or an agent of management, such as staff augmentation working under the organization's direction. A consultant who helped design, implement or operate a control cannot then test that same control and still count as objective. Confirm the party's role in writing before the work starts. You can look up firms on the Find an External Assessor or Readiness Licensee page. Use it as a search tool, because appearing there does not signal endorsement of any firm's work.

How does the 20% reperformance rule affect assessor fees and timing?

When an External Assessor relies on internal sample testing, it must reperform at least 20% of the samples and must still lead or take part in walkthroughs of the control environment. The fee effect depends on how many samples are drawn from your internal work, how complete the workpapers are, and how much the assessor must rebuild. Cleaner documentation usually shortens reperformance and the follow-up questions that come with it. For timing, reperformance requires the underlying evidence to be available during fieldwork, and that evidence must still be within 90 days of testing. Validated assessment fieldwork may run at most 90 days, so late evidence or late walkthroughs can push work outside the window the assessor plans around. Ask how the 20% sample will be chosen, when the evidence is needed, and whether reperformance is billed separately or within the agreed scope. No percentage of fee or number of weeks is given here, so the written quote should reflect your sample count and environment.

What should we confirm with the External Assessor early?

Settle these points before internal testing starts, so the work is designed for reliance from the beginning:

Whether the internal function's approval status and testing scope fit the planned assessment, and how the assessor will verify them.
Which requirements the internal team will test, and which the assessor will test directly.
The sample selection method for the 20% reperformance, and the evidence dates the assessor expects.
How walkthroughs will be scheduled and who from the assessor will lead them.
The workpaper format, storage and retention the assessor requires under the testing and documentation rules in the HITRUST Assessment Handbook.

Get the answers in writing, since they shape both the scope and the quote.

How do we check that HITRUST has approved our internal assessor function?

HITRUST approval of an internal assessor function is a status you must confirm with HITRUST. Do not assume it from internal policy or a job title. Ask HITRUST in writing for the function's approval status and keep that confirmation in the assessment file. Also verify that each person who performs testing holds a current CCSFP credential, because every testing hour must come from CCSFP holders. Your External Assessor can check the approval record and staff credentials during planning. For outside firms, the Find an External Assessor or Readiness Licensee page lets you search for External Assessors and readiness licensees, which helps you confirm an outside party's standing. Re-check status before each assessment window, since the rules apply to the testing you rely on at the time it is performed.

Can an internal team with the same reporting line test IT controls?

No, not with objectivity intact. HITRUST says objectivity does not exist when the internal assessor function and the function being assessed, such as IT, roll up to the same leader. As an illustrative example, if the internal assessment team and the IT operations group both report to the CIO, the team cannot treat its IT access testing as objective, and an External Assessor should not rely on it without a separate basis. Objectivity is also lost when internal assessors helped design, implement or operate the controls they test. To fix this before the assessment, change the reporting line, assign testers who had no role in the control, or have an outside party test those controls under one of the recognized roles. Document the reporting structure and each tester's role in the file, because the External Assessor will ask for it during planning.

How DeployOpen prepares systems and evidence for internal testing

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the evidence your team produces for HITRUST internal assessor testing is generated, retained and dated in a way your External Assessor can review. We prepare systems and evidence only; the organization owns its controls and the External Assessor issues the validated results.

How we scope

Each engagement starts with a written scope that names the HITRUST requirements, platforms and environments your internal assessors will test.
We confirm with you which teams perform the testing and which teams operate the controls, so objectivity conflicts are identified before work starts.
Scope documents state who holds CCSFP credentials among the testing staff, since HITRUST requires that all internal assessor testing hours come from CCSFP holders.

How we build

We configure self-hosted platforms so logs, access records and configuration history are collected continuously and retained in a form your testers can sample.
We document each control's design, owner and operating procedure, keeping the people who built the controls separate from the people who test them.
We set evidence collection routines so artifacts stay within the 90-day evidence age limit that HITRUST applies to internal assessor testing.

How we hand over

You receive runbooks, evidence maps and sample-ready extracts that let internal testers reproduce each test step on their own.
We deliver a written record of the testing approach, including how samples were selected and where walkthrough material is stored for the External Assessor.
Handover includes a review session with your internal assessors and External Assessor liaison so reperformance expectations, including the 20% reperformance rule, are understood.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, so evidence routines keep running between assessment cycles.
We can update documentation and evidence routines when the CSF version changes or when your platforms are upgraded.
Confirm with your External Assessor and HITRUST which internal testing reliance rules apply to your engagement before relying on any output.