What to outsource for HITRUST and what to keep in-house

If a customer or contract now requires HITRUST, you keep ownership of your controls, scope, evidence, disclosure and funding. An implementation partner can prepare your systems and evidence, but only an Authorized HITRUST External Assessor performs the validated assessment, and HITRUST performs central quality assurance before any report is issued. Under the HITRUST Assessment Handbook (v1.1), the assessed entity implements the CSF controls, defines and communicates scope, supplies complete evidence, discloses known deficiencies, funds the assessment and corrective actions, and reports significant changes and security events. Those duties cannot be handed to a consultant or an assessor. Your first decision is therefore not which firm to hire but which of these duties you can staff internally, because a partner cannot sign for them.

The exact split depends on your scope, your staffing and the independence bar. Personnel who helped implement or operate the controls in the prior 12 months cannot work on the validated assessment, so the people who wrote your policies or built your logging may need to stay off the assessment team. Assessor staff may still provide readiness or gap assessments, penetration testing and vulnerability scanning to the same entity, but the Handbook excludes remediation such as writing your policies or operating your controls from that allowance. Before engaging an External Assessor, confirm who on the proposed team has done prior implementation work for you, and map which readiness tasks will go to a separate team. HITRUST's Getting Started checklist recommends naming a project owner and internal champions before you begin, which gives you a clear internal owner for each split.

Put the split in writing before any work starts. Ask the partner which artifacts it will prepare, who will review them, and which tasks it will not touch. Ask the External Assessor to confirm in writing that its team has no disqualifying prior work, and ask how it will check evidence age against the 90-day window the Handbook applies to fieldwork and evidence. Under the Handbook's internal assessor rules, an assessor may rely on your own testing only if HITRUST has approved that function and its work meets HITRUST's testing rules, so decide early whether internal audit will test any requirements. The Handbook also states that HITRUST cannot guarantee that any External Assessor will succeed on a given engagement, so your own due diligence before signing is part of your duty. Confirm current requirements with HITRUST, since the assessment rules and CSF version may change.

Who does what: your team, a partner and the External Assessor

Under the HITRUST Assessment Handbook (v1.1), the assessed entity owns the certification. Your team implements and operates the CSF controls in your own environment, which no partner or assessor can do on your behalf. It also defines and communicates the assessment scope, and it is responsible for the outcome of the work.

Controls and operation: Your staff implement and run the controls day to day, so the evidence reflects real operation rather than a one-time build.
Scope and communication: You define the systems, locations and services in scope and tell the people involved what the assessment requires.
Complete evidence: You supply full, accurate evidence to the External Assessor, including items that show weaknesses.
Disclosure and funding: You disclose known deficiencies, fund the assessment and fund the corrective actions it identifies.
Reporting to HITRUST: You report significant changes and security events to HITRUST during the certification period.

Confirm internally who holds each of these duties, since the assessor will ask for named owners.

Why the 12-month bar decides who can do what

The 12-month bar decides which people can work on the validated assessment. Under the HITRUST Assessment Handbook (v1.1), personnel who helped implement or operate the controls in the prior 12 months cannot take part in the validated assessment (section 3.3.5). In practice, the team that configured your logging, wrote your access review procedure or ran your vulnerability program is usually the same team that would be asked to explain it to the External Assessor, and that team is barred. Before you sign anything, map who on the proposed assessment team touched your controls in the last year and who did not, then ask the assessor to confirm that its staff pass the same test.

This is why readiness consulting and the validated assessment often need separate teams. A partner that builds controls, drafts policies or operates systems for you is in the bar's scope, so it should not also be the validated assessor's staff for the same controls. The practical split is that the partner prepares systems, evidence and documentation, while the External Assessor tests them independently. Ask any readiness provider to name the people it will assign, state what each has done for your environment, and confirm they will not appear on the validated assessment. Also ask the assessor whether it can provide the readiness work itself, since the rules on that depend on what was done and by whom.

Due diligence stays with you. Under section 3.1.12 of the Handbook, the assessed entity must perform its own due diligence before engaging an External Assessor, and HITRUST states that it cannot guarantee any External Assessor will succeed on a specific engagement. Verify the firm on HITRUST's Find an External Assessor or Readiness Licensee listing, check references from comparable organizations, and confirm the scope, deliverables and timeline in writing. A passing result depends on your controls and evidence, so plan internal ownership and a corrective action path regardless of who you hire.

Which HITRUST work to keep in-house

HITRUST places the core obligations of a validated assessment on the assessed entity, not on its advisers or its External Assessor. The cards below cover the responsibilities that stay with your organization, and why a partner can prepare them but cannot take them over.

Named project owner and champions

HITRUST's Getting Started checklist recommends naming one project owner and internal champions before work begins. The owner holds the schedule, decides trade-offs between teams and is the person the External Assessor and HITRUST contact. A partner can run the workplan day to day, but accountability for finishing the assessment stays with your employee. Check that the owner has the authority to pull engineers and system owners into the work and that the role is named in writing.

Leadership education and orientation

Leadership has to understand what the certification commits the organization to, including scope, funding and the disclosure duty. HITRUST recommends educating leadership and attending its New Customer Orientation before starting. A consultant can prepare the briefing, but a partner cannot make the decision to commit budget or accept the terms on the organization's behalf. Ask whether your executive sponsor has attended orientation and can explain the assessment's obligations without help.

Control ownership and operation

The Assessment Handbook makes the assessed entity responsible for implementing the CSF controls. Each control needs a named owner inside your organization who runs it day to day, such as the access review owner or the change approver. A partner may draft procedures and configure tooling, but once a control is implemented, your staff must operate it and produce its records. Confirm that every control has an owner who can answer questions about it during fieldwork.

Scope definition

The entity defines and communicates the scope of the assessment, including which systems, facilities and business processes fall inside it. Scope decisions drive every later cost and control, so a partner should not set the boundary on its own. Your team should own the system inventory and the data flows that justify each inclusion or exclusion, and should be able to explain them to the External Assessor.

Evidence completeness and disclosure

HITRUST expects the entity to supply complete evidence and to disclose known deficiencies, even when a finding is unfavorable. A partner can organize and review evidence, but it cannot decide what your organization knows about its own gaps. Set an internal rule that known deficiencies are reported to the External Assessor and not held back until fieldwork. Ask who signs off that evidence is complete before the assessor starts testing.

Funding and corrective action decisions

The entity funds the assessment and any corrective actions, and it decides whether to fix a gap, accept it or change scope. These are business decisions that a consultant can price and recommend but not approve. Build a budget line for remediation before the assessment window opens, and keep a record of who approved each corrective action and its due date.

Which parts to outsource, keep or split across teams

This table compares seven pieces of HITRUST work against three options: keep in-house, hand to an implementation partner, or leave with the External Assessor for the validated assessment. Read each row against your own team's experience, and treat the validated fieldwork row as the fixed boundary that other work must stay clear of.

Work type	Keep in-house	Partner or External Assessor
Scope definition	Yes. The assessed entity must define and communicate scope itself, so leadership and system owners sign it off.	Partner can draft scope options for review. The External Assessor confirms it during the validated assessment.
Policy and procedure writing	Preferred where you have staff who can own and run the policies day to day.	Partner may write policies during readiness. The External Assessor may review policies but cannot write them.
Control implementation	Yes for controls your team will operate. Ownership of operating controls stays with you under the Handbook.	Partner can implement and harden controls in your environment. The External Assessor may not implement or operate controls for you.
Evidence collection	Yes. You must supply complete evidence and keep it current, including evidence age limits for internal testing.	Partner can build evidence routines and collection tooling. The External Assessor tests evidence but does not gather it for you.
Internal testing	Suits an internal audit function or internal assessor team that HITRUST has approved and whose testing hours are by CCSFP holders.	Partner can run readiness testing. Its staff may not also be on the validated assessment if they helped implement the controls in the prior 12 months.
Readiness gap assessment	Possible only if your staff are independent of the controls being reviewed and can record findings candidly.	Partner or a separate assessor firm is commonly used. Assessor staff may provide it to the same entity, subject to HITRUST's independence rules.
Validated fieldwork	Not applicable. Your team supports fieldwork but does not perform it.	External Assessor only. Only Authorized HITRUST External Assessor organizations perform validated assessments submitted for certification.

How to sequence the engagement so independence holds

The sequence keeps the people who build your controls separate from the people who test them, so the External Assessor can rely on the work and the validated assessment remains independent. Each step has a named output that you can check before moving on.

Name a project owner and read the Getting Started checklist
Your organization appoints one accountable project owner and internal champions, then the owner reads HITRUST's Getting Started checklist and briefs leadership on what the assessment asks of the business. Leadership is educated before any partner is hired, so the scope and budget decisions are made by the assessed entity. The step is done when the owner has a written list of champions, a leadership briefing has been held, and the team has attended HITRUST's New Customer Orientation.
Define and document the assessment scope
Your team defines and communicates the systems, facilities, data and business units in scope, because the Handbook makes the assessed entity responsible for scope. Your own staff owns this decision, and any partner you consult later works from it rather than setting it. The output is a signed scope statement that lists in-scope assets, exclusions and the rationale for each exclusion, which every later engagement document references.
Choose the readiness team and separate it from the validated assessment
Decide which firm or internal group will run readiness work, such as gap assessments, policy consulting and control build-out. Record the people who implement or operate controls, because personnel who helped implement or operate them in the prior 12 months cannot work on the validated assessment. The output is a staffing register that marks each person as readiness or assessment, reviewed by the project owner before any readiness work begins.
Run readiness work with one team
The readiness team closes gaps, writes or revises policies and procedures, and operates the controls, while your staff collects evidence as the work happens. Keeping one team responsible for readiness avoids mixing advice with testing inside the same engagement. The output is a readiness record showing each control, its owner, the evidence location and the date it was implemented, which the assessor will later sample.
Observe the 12-month gap before the validated assessment
If your readiness partner helped implement controls, confirm that the 12-month bar has passed before its personnel join any validated work. Ask the External Assessor to confirm in writing how it applies the bar to your partner's staff and to your own implementation staff. The check is complete when the assessor has accepted the staffing register in writing, with any exceptions identified before fieldwork starts.
Select an Authorized External Assessor
Choose an organization from HITRUST's list of Authorized External Assessors, since only those firms may perform validated assessments submitted for certification. Complete your own due diligence on the firm, its staffing and its conflicts, because HITRUST cannot guarantee any assessor will succeed on a given engagement. The output is a signed engagement letter that states the scope, the independence commitments, and which of your staff and partner personnel the assessor will and will not accept.
Complete fieldwork inside the 90-day window
The External Assessor performs validated fieldwork within a window of at most 90 days for e1, i1 and r2 assessments. Your team supplies complete evidence, discloses known deficiencies and answers assessor questions, while the readiness partner stays out of the testing. The output is a fieldwork close-out record listing requests, responses and open items, with any internal testing relied upon confirmed as meeting HITRUST's testing and evidence age rules.
Clear HITRUST quality assurance before the report is issued
After fieldwork, the External Assessor submits the assessment for HITRUST's central quality assurance, which HITRUST performs before issuing any report. Your team responds to QA questions through the assessor and does not contact HITRUST reviewers to change results on its own. The step is done when HITRUST issues the report or certification, and the assessed entity has a copy of the outcome along with the list of any corrective actions.

Common questions about outsourcing HITRUST work

Can a consultant write our policies and still take the validated assessment?

Not on the same engagement, if the consultant also helps implement or operate your controls. Under the HITRUST Assessment Handbook (v1.1), assessor staff on a validated assessment may still provide policy and procedure consulting, readiness or gap assessments, penetration testing and vulnerability scanning to the same entity. Remediation is excluded, which means writing your policies or implementing or operating your controls. Your own staff own those policies and must be able to explain them. Ask any firm to show, in writing, which people did which work and whether they touched the controls in the prior 12 months, because personnel who helped implement or operate the controls in that window cannot work on the validated assessment. Many organizations therefore split readiness and validation across separate teams from the start.

Can our internal audit team test controls for the assessment?

Yes, but only if HITRUST has approved your internal assessor function and the testing meets its rules. The External Assessor may rely on your internal testing only when the function is approved and objective, all of its testing hours are performed by CCSFP holders, its evidence is no more than 90 days old, and its work meets HITRUST's testing and documentation rules (Handbook section 12.4). Internal audit staff who helped build or run the controls are not objective for this purpose. Confirm approval status, staffing and evidence dating before planning around internal testing. Your External Assessor still decides what it relies on.

How much of the HITRUST work can we do ourselves?

Most of the operational work can stay in-house, while the validated assessment itself must come from an authorized External Assessor. Under the Handbook, the assessed entity implements the CSF controls, defines and communicates scope, supplies complete evidence, discloses known deficiencies, funds the assessment and any corrective actions, and reports significant changes and security events to HITRUST (section 3.1). Those duties cannot be handed to a partner. What a partner can take on is preparation: gap assessments, evidence mapping, project management and technical hardening, as long as the readiness team stays separate from the validated assessment team. The split depends on how mature your controls already are, how many systems fall in scope, and how much staff time you can release.

Does hiring an implementation partner guarantee a passing result?

No. The Handbook states that HITRUST cannot guarantee that any External Assessor will succeed on a specific engagement, and it places due diligence on the assessed entity before engaging one. A partner can improve readiness by preparing systems, controls and evidence, but the result depends on whether your controls operate as described, whether your evidence is complete and current, and whether the assessor agrees with your scoping. Treat any promise of a pass as a warning sign. Ask for a written statement of deliverables and what happens if a domain needs corrective action.

What does the work need from our own staff?

It needs named owners who can make decisions and produce evidence. HITRUST's Getting Started checklist recommends naming a project owner and internal champions, educating leadership, and attending HITRUST's New Customer Orientation before starting. In practice, your team must own the scope statement, the system inventory, access reviews, change records, incident handling and vendor management, because those are the activities an assessor samples. Plan staff time for interviews, evidence requests and remediation work, and keep anyone who builds controls out of the validation team. A partner can run the project, but it cannot be the only place where the knowledge sits.

Who pays for what when a partner and an assessor are both involved?

The assessed entity pays for every party in the chain, and each cost has a different driver. You pay the External Assessor for the validated assessment, the partner for readiness and implementation work, and HITRUST for platform and report items. The Handbook makes the assessed entity responsible for funding the assessment and corrective actions, so remediation costs sit with you even when a partner performs the work. Costs recur when you renew or move to a higher assessment, and they rise with scope, system count and the number of corrective action cycles. Ask each provider for a separate quote that names its deliverables, its hourly or fixed basis, and any items it expects to bill later, such as change fees or follow-up testing.

How DeployOpen prepares systems and evidence for HITRUST

DeployOpen plans, implements, hardens, backs up and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and prepares the controls and evidence that your team and the External Assessor will examine. Our work is the technical and documentary groundwork: configuring logging and access controls on the platforms you run, setting up backup and recovery routines, writing the runbooks that show how those controls operate, and organizing the artifacts that map to each in-scope requirement. The organization remains the owner of its controls, and the systems we deliver are yours to operate after handover.

DeployOpen does not issue HITRUST reports or certifications. Only an Authorized HITRUST External Assessor performs the validated assessment, and HITRUST performs its own quality assurance before any report is issued. We have no role in deciding whether a requirement is met, and we do not present our work as an assessment result. Before we start, we agree the scope, deliverables and timeline in writing, so you know which platforms, environments and requirements are covered and which remain with your team or another provider. Engagements are fixed-scope, and ongoing support, upgrades and continuous testing are available as separate retainers.

Before you engage us, confirm with your External Assessor which evidence they expect in the form they will test it, including its age and the sampling approach they plan to use. Ask us to map the scoped work to the requirement statements in your assessment, and ask your assessor to confirm that the artifacts are acceptable. Keep a clear record of who performed each task, since personnel who helped implement or operate controls in the prior 12 months cannot work on the validated assessment. Agreeing these points early reduces rework and keeps the independence line between preparation and validation intact.

What to outsource for HITRUST and what to keep in-house