MyCSF subscription and report credit costs

What do MyCSF subscriptions and report credits cost on top of the assessor's fee?

HITRUST charges for a MyCSF subscription and for validated assessment report credits, and it does not publish prices on its public assessment pages, so buyers request a quote from HITRUST sales. The final figure depends on the assessment type (e1, i1 or r2), the subscription tier, whether compliance factors are added to form a combined assessment, and when the work is scheduled. Ask HITRUST for a written quote that names each line item: the subscription term and tier, the number of validated report credits, any Insights Report credits per factor, and the change fee terms.

The External Assessor's fee and any implementation partner fees are separate from HITRUST's charges, and each is paid to a different party. The MyCSF subscription is what gives your team access to the platform where the assessment is scoped, submitted and reported, so it is needed whether or not you use outside help. Validated report credits are needed to reserve a quality assurance slot, and a missed submission date cancels the reservation and triggers a change fee, so the timing of your fieldwork window directly affects what you pay. Confirm with the assessor and HITRUST which dates are fixed before you commit to a subscription tier.

Before signing, confirm whether your rapid assessment or lite option requires a full subscription, because HITRUST's assessment handbook sets that requirement for rapid assessments. Also confirm which costs recur at renewal, including the subscription and report credits for any r2 interim assessment, and which are one-time. Budget for a change fee as a contingency, since scope or date changes are common in readiness work. The HITRUST MyCSF page describes what the platform includes, which helps you check the quote against the workflows your team will actually use.

Which HITRUST platform costs are one-time and which recur

This table compares each HITRUST-related cost by who gets paid, whether it is one-time or recurring, and what changes the amount. Use it to frame a quote request, since HITRUST does not publish prices and the External Assessor and implementation partner quotes follow from your written scope.

Cost component	Who is paid	One-time or recurring	What drives it
MyCSF subscription	HITRUST	Recurring, billed for the subscription term	Subscription tier, number of users and whether you need rapid assessment access. Confirm current terms with HITRUST sales.
Validated assessment report credit	HITRUST	One-time per validated assessment	Required to reserve a HITRUST QA slot. Confirm the credit price and whether it is bundled with your subscription.
Insights Report credit per compliance factor	HITRUST	One-time per factor in a combined assessment	Number of compliance factors added to an e1 or i1. Each factor needs its own credit before submission.
Rapid assessment subscription upgrade	HITRUST	Recurring as part of a full subscription	Lite Bundle users must move to at least a Professional subscription. Ask whether the upgrade changes your renewal cost.
Change fee	HITRUST	One-time, triggered by a missed submission date	Missing the date set in the QA reservation cancels it. Plan submission dates with buffer to avoid this charge.
External Assessor fee	Authorized External Assessor firm	One-time per validated assessment, with interim work at r2 renewals	Scope, assessment type, number of systems and evidence volume. Request a written scope and fee from each assessor you shortlist.
Implementation partner fee	Your chosen readiness or implementation partner	Usually one-time for a fixed-scope project, plus any ongoing support retainer	Readiness depth, remediation work and inheritance planning. This sits alongside HITRUST and assessor costs, not inside them.

What makes the platform bill larger or smaller

The MyCSF side of a HITRUST engagement is driven by a few levers you control: which assessment you pick, whether you add compliance factors, which subscription tier you hold, how many teams use the platform, and when you lock your QA date. Each one changes how many credits and subscriptions you buy, and some changes also trigger fees if they slip.

Choosing the assessment type

The e1, i1 and r2 carry different requirement counts and different certification terms, so the assessment you choose sets the scope of work that flows through MyCSF. Every e1 requirement sits inside the i1 and every i1 requirement sits inside the r2, so starting smaller and stepping up is a traversable path. Before you buy, confirm with your External Assessor which assessment your contract or customer actually requires, because a larger assessment than needed adds scope and time you will still pay for.

Adding compliance factors

An e1 or i1 can carry added compliance factors, which produce an Insights Report for each authoritative source. Each factor needs its own Insights Report credit before submission, so every factor you add is a separate purchase on top of the base assessment. Certification still counts only the core requirement statements, so ask whether each factor is needed for a contract or regulator before you add it.

Subscription tier for rapid assessments

A rapid assessment produces the same i1 or e1 reports and one-year certification as a full assessment, but it requires a full MyCSF subscription. A Lite Bundle does not qualify, so teams that plan a rapid assessment must budget for at least a Professional subscription from the start. Ask your HITRUST contact which tier covers your planned assessment type before you sign, since buying a lower tier first and upgrading later adds a cost you could have avoided.

Number of teams using the platform

A MyCSF subscription is tied to the Assessed Entity, so the number of business units, product lines or separate legal entities that need their own assessment directly sets how many subscriptions and report credits you need. Consolidating into one assessed scope where the business allows can reduce that count. Confirm with HITRUST how subscriptions are allocated when several teams share one scope, and who in your organization holds Report Center access.

Locking the QA date early

A validated assessment report credit is required to reserve a HITRUST QA slot. If you miss the submission date set in that reservation, the reservation is cancelled and a change fee applies, so a late submission costs money on top of the lost slot. Set the QA date only after your remediation plan is realistic, and ask HITRUST for the change fee schedule in writing before you commit.

Version and deadline timing

HITRUST publishes new CSF versions with their own creation deadlines, and an assessment started under an older version may need to be moved or recreated. Check the current advisory on creation deadlines before you buy credits, so you do not pay for a report credit that falls outside the window you planned. Ask HITRUST to confirm in writing which version and deadline apply to your assessment.

When to buy each credit in the HITRUST sequence

HITRUST's Getting Started order moves you from choosing an External Assessor to a submitted validated assessment, and each purchase unlocks the next step. Following it in order keeps your QA reservation and fieldwork window from slipping.

Choose an External Assessor first
Select an Authorized HITRUST External Assessor organization before you buy anything in MyCSF. Only these firms can perform the validated assessments submitted for certification, and HITRUST runs central quality assurance before it issues reports. Confirm the firm's authorization on HITRUST's Find an External Assessor listing and ask for a written scope and fee proposal. You know this step is done when you hold a signed engagement letter naming the assessment type. The assessor's fee is separate from anything HITRUST charges you.
Buy a MyCSF subscription
Purchase a MyCSF subscription, which is the SaaS platform where assessments are created, scoped, tailored and submitted. Your assessor will work inside your account, and the Assessed Entity accesses the platform through this subscription. Ask HITRUST or sales which subscription tier you need, because the tier affects whether a rapid assessment is available. Your output is an active account with named admins who control the Report Center and who can see reports. Confirm that the subscription covers the assessment type you plan to run.
Buy a validated assessment report credit
Purchase the validated assessment report credit. A credit is required before you can reserve a HITRUST QA slot, so you cannot secure a QA date without one. Confirm with HITRUST whether the credit must be in place before the reservation or before submission, and whether a combined assessment needs additional Insights Report credits. Ask for the credit's terms in writing. The output of this step is a credit assigned to your assessment in MyCSF, visible on the account before you reserve QA.
Run the readiness assessment and remediate gaps
Your assessor or readiness partner runs the readiness assessment in MyCSF, covering scoping, inheritance planning and gap identification. Use the results to decide which requirements need remediation and to set owners for each gap. This work happens before the validated assessment, and HITRUST's Getting Started guidance treats remediation as a precondition for fieldwork. The output is a scoped assessment with documented gaps, owners and evidence plans. Your assessor's fieldwork is then limited to a validated assessment window of at most 90 days, so the remediation must be finished before that window opens.
Reserve a QA date
Reserve a HITRUST quality assurance slot in MyCSF once your assessment is ready for validation. The reservation requires a validated assessment report credit, so confirm you hold one before you book. The output is a confirmed QA date shown on the assessment record. Record that date in your project plan and assign one person to own it, because the date is contractual in practice.
Submit the assessment before the reserved date
Submit the completed validated assessment on or before the submission date set in the QA reservation. Missing that date cancels the reservation and triggers a change fee, so build an internal submission deadline earlier than the official one. Your assessor completes fieldwork within the 90-day window, then the assessment moves to HITRUST QA. The output is a submitted assessment with a submission confirmation in MyCSF. Check the confirmation against your plan before you consider the step closed.

How a combined assessment adds Insights Report credits

An e1 or i1 can be extended into a combined assessment by adding compliance factors, and each added factor produces an Insights Report for its authoritative source. The platform cost is therefore not one credit per assessment. Each factor you add needs its own Insights Report credit before you submit, so the credit count in your MyCSF subscription has to match the factors you plan to include at the time you reserve the QA slot. Certification itself is unchanged: it still counts only the core requirement statements of the e1 or i1, not the requirements that come in through the factors.

*Illustrative example, not a quote:* suppose an organization runs an i1 and wants Insights Reports for two added factors. It would need the validated assessment report credit for the i1, plus two Insights Report credits, one per factor, before submission. If it later decides to add a third factor, that is one more Insights Report credit to buy before the submission date, and the change may affect the QA reservation. Ask HITRUST or your External Assessor to confirm the credit count for each factor you intend to include, and build that count into the budget before scoping begins.

Decide the factor list early, during readiness scoping, because adding factors late creates both a credit purchase and extra evidence work for the assessor. Confirm with your External Assessor whether each factor's requirements are fully covered by the same evidence set, and confirm with HITRUST how credits are assigned and expire in your subscription. The HITRUST Assessment Handbook sets out the combined assessment rules and should be read alongside your quote.

Which subscription tier fits your assessment plan

If you are pursuing a full validated assessment, whether an e1, i1 or r2, your planning starts with a full MyCSF subscription. The subscription gives your team access to the platform where scoping, tailoring, remediation, validation and reporting are managed, and it is the account through which the Assessed Entity works with the External Assessor. Report credits are a separate purchase that you need before a HITRUST quality assurance slot can be reserved.

Subscription access: Confirm which users, roles and report access your tier includes, including who can control the Report Center.
Report credits: Plan one validated assessment report credit for each validated assessment you intend to submit for QA.
Inheritance features: Ask whether the tier you are buying supports the inheritance workflows your scope depends on.
Insights Reports: If you plan a combined assessment with compliance factors, price the Insights Report credits separately.
Renewal timing: Map subscription and credit dates against your readiness work and submission date.

Ask HITRUST sales to confirm current tier names, inclusions and what a full subscription covers for your specific assessment type before you sign.

Platform cost surprises that delay a HITRUST project

Most delays in the HITRUST platform budget come from buying in the wrong order: credits before scope, factors added late, or a subscription tier that cannot support the assessment type. Each card below names one common surprise, why it hits MyCSF subscriptions and report credits, and what to confirm before money changes hands.

Missing the QA submission date

A validated assessment report credit reserves a HITRUST QA slot. If the submission date set in that reservation passes without a submission, the reservation is cancelled and a change fee applies. Before booking, confirm with your External Assessor that fieldwork, remediation and internal review can finish well before the date, and ask HITRUST for the current change fee in writing.

Buying credits before scope

Report credits are tied to the assessment you intend to run, so buying them before the scope is settled can lock you into the wrong type or size. Finish the readiness assessment, scoping and inheritance planning first, then buy the credits that match the agreed scope. Ask whether unused credits can be applied to a different assessment before purchase.

Adding compliance factors late

An e1 or i1 can carry compliance factors that produce an Insights Report for each authoritative source. Each factor needs its own Insights Report credit before submission, so a factor added after purchasing credits means buying more credits and possibly adjusting timelines. Decide the factor list during scoping, and remember that certification still counts only the core requirement statements.

Buying a tier too low for rapid assessments

Rapid assessments produce the same i1 or e1 reports and one-year certification as a full assessment, but they require a full MyCSF subscription. Lite Bundle users must upgrade to at least a Professional subscription. Confirm your tier against the assessment type before committing, because an upgrade mid-project adds cost and can disrupt the schedule.

Assuming the subscription covers assessor fees

A MyCSF subscription pays for the platform, not for the External Assessor's fieldwork, review or reporting. Assessor fees, readiness consultant fees, remediation work and HITRUST credits are separate line items. Ask every vendor in writing which costs are included in their quote and which are billed separately, and keep those lines apart in your budget.

Who owns the platform, the controls and the certificate

The assessed entity buys the MyCSF subscription and the validated assessment report credits, administers them, and owns the controls, evidence and results that go into its assessment. A MyCSF subscription is the access route to HITRUST's platform for creating, scoping and submitting an assessment, and report credits are what reserve the HITRUST quality assurance slot. Those purchases sit in your name, so the person who signs the order should also be the person who decides how the subscription is administered. Confirm with HITRUST which users can hold admin rights for your subscription before onboarding anyone, and record who approved each credit purchase.

Access to finished reports is a separate decision from access to the platform. MyCSF's Report Center lets administrators control who can open reports, so set that list deliberately. Limit it to people who need the report for a contract, a board briefing or a customer response, and review it whenever staff or consultants change. A partner that helps prepare the assessment inside MyCSF workflows needs working access to tailoring, remediation and evidence uploads, but it does not need to be on the report distribution list. Ask your implementation partner to show, in writing, which MyCSF roles it will hold and what it will not be able to see or change.

Your organization also keeps ownership of the controls themselves. A partner such as DeployOpen can plan the readiness work, configure self-hosted systems, collect and organize evidence, and document how each control operates, all within the scope you agree in writing. It does not issue reports or certificates. Only an authorized External Assessor may submit the validated assessment, and HITRUST performs central quality assurance before it issues the report. The certificate is therefore the result of an independent process that the partner supports but does not control. Before you sign, confirm that your partner and your External Assessor have separate, documented roles, and that no party will edit evidence after the assessor has tested it.

Common questions about HITRUST platform costs

How much does MyCSF cost and why doesn't HITRUST publish prices?

MyCSF pricing is not published on HITRUST's public assessment pages, which direct buyers to request information or contact sales. The subscription cost depends on the tier you need, the assessment type you plan to run and the number of credits you buy, so the figure only becomes concrete once you describe your scope. Ask HITRUST for a written quote that lists the subscription tier, each report credit, any Insights Report credits and the terms that apply if a QA date moves. Compare that quote with the assessor's fee, which is paid separately and is not covered by the subscription.

Does a MyCSF subscription cover the External Assessor's fee?

No. A MyCSF subscription gives your team access to HITRUST's platform for creating, scoping, tailoring, remediating and submitting an assessment. The External Assessor, which must be an Authorized HITRUST External Assessor organization for a validated assessment, bills its own fee for fieldwork and reporting. HITRUST also performs central quality assurance before it issues a report, and that step is tied to a report credit. Confirm in writing which fees are billed by HITRUST and which by your assessor, so neither invoice surprises the budget.

What is a HITRUST validated assessment report credit used for?

A validated assessment report credit is required to reserve a HITRUST quality assurance slot. Without one, you cannot book the QA review that precedes issuance of the report. Think of the credit as the entitlement that lets an assessment move from submission into HITRUST's central review. Confirm with HITRUST how many credits your planned assessment consumes and whether a credit can be reused if the assessment is rescheduled.

When do I need Insights Report credits for a HITRUST assessment?

You need Insights Report credits when you run a combined assessment. An e1 or i1 can add compliance factors, and each factor produces an Insights Report for its authoritative source. Each factor requires an Insights Report credit before submission. Certification still counts only the core requirement statements of the e1 or i1, so the extra credits buy reporting on the added sources rather than additional certification. If you only need the e1, i1 or r2 certification, you may not need these credits. Ask HITRUST to map your required sources to the credits they would consume.

What triggers a HITRUST change fee?

A change fee is triggered when a QA reservation is cancelled. If the submission date set in your reservation passes and you have not submitted, HITRUST cancels the reservation and charges a change fee. Plan the submission date with your assessor well before the QA slot, and build in buffer for remediation and evidence review. Ask HITRUST for the current change fee amount and the rescheduling terms in writing before you reserve a date.

Can my organization run MyCSF itself without an outside partner?

Yes, your organization can use MyCSF directly with a subscription. The platform supports tailoring, remediation tracking, validation workflows, reporting and a Report Center where admins control who can access reports. HITRUST describes inheritance of up to 85% of applicable controls within the platform. Running the platform yourself does not remove the need for an Authorized HITRUST External Assessor to perform the validated assessment, and it does not change who issues the certification. An implementation partner can prepare scope, evidence and systems, but the organization owns its controls and the independent assessor issues the report.

How long does a MyCSF subscription commitment last?

The supplied facts do not state the length of a MyCSF subscription term, renewal rules or cancellation terms. Confirm the minimum commitment, billing frequency, renewal behavior and what happens to your assessment data if you stop renewing before you have a certification in hand. Also confirm how the subscription interacts with the one-year e1 and i1 certifications and the two-year r2 certification, including the r2 interim assessment due in the 90 days before the first anniversary. Get these terms in the order form, not from a sales call.

How DeployOpen prepares your HITRUST evidence before the QA date

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the evidence your team needs for a HITRUST validated assessment is in place before the QA date. We prepare systems and records for your MyCSF workflow; the organization owns its controls, and only an Authorized HITRUST External Assessor issues the validated report.

How we scope

We agree a written, fixed scope that names the systems, environments and assessment type in question before work starts.
The scope states which MyCSF subscription tier and report credits the planned assessment path requires, so budget owners see them up front.
Ongoing support, upgrades and continuous testing can be added as a retainer, priced separately from the fixed-scope work.

How we build

We configure the self-hosted platforms that generate evidence, such as logging, access control and vulnerability records, to the scope agreed with you.
We document how each platform's output maps to the requirement statements your External Assessor will test, using your own tailoring decisions.
We test the evidence pipeline end to end so exports are complete, dated and retrievable when the assessor requests them during fieldwork.

How we hand over

We deliver configuration records, runbooks and evidence collection procedures that your staff can operate after the engagement ends.
We provide an evidence index that lists each artifact, its owner and its collection date, ready for upload to MyCSF.
We walk your team through the handover so that credit purchases, QA reservations and submission dates are owned by named people.

How we support

We offer retainers for upgrades, backups, hardening and ongoing evidence checks between assessment cycles.
We help you confirm with HITRUST and your External Assessor which subscription tier and credits apply when a scope or tier changes.
We remain available to answer evidence questions, but we do not issue reports, certifications or QA sign-off, which remain with HITRUST and the assessor.

MyCSF subscriptions, report credits and HITRUST platform costs