HITRUST bridge assessment: avoiding a gap after r2 expiry

What a HITRUST r2 bridge assessment does when recertification runs late

An r2 bridge assessment is open only to r2 holders who are no more than 30 days past their recertification date and have no reportable breach or significant change, and it yields a certificate valid 90 days from expiry. If your r2 is close to its recertification date and fieldwork will not finish in time, the bridge is the mechanism that can close the gap, but only if your organization meets those conditions. Confirm the exact dates on your current certificate in MyCSF and check with your external assessor whether any change since your last report would disqualify you before you plan around it.

Three questions decide the answer for each organization. The first is eligibility: whether you are within the 30-day window and whether any breach or significant change, such as a cloud move, replacement of an in-scope application or a change of service provider, has occurred since the last validated assessment. The second is the test itself: the bridge assessment examines 19 requirement statements selected at random by HITRUST, so you cannot prepare for a fixed list and should confirm that your evidence is current across all 19 domains of the r2 scope. The third is the effect on the next certification. The 90 days covered by the bridge are deducted from the new r2's 24-month validity, and the 19 tested requirements do not need to be retested in the full assessment. Ask your assessor to model those dates before you commit to a schedule.

Roles matter here. Your organization owns its controls and the decision to pursue a bridge. An implementation partner can help prepare systems, evidence and the bridge submission package, but it does not perform the assessment or issue anything. Only an authorized HITRUST External Assessor organization can perform the validated assessment, and HITRUST issues the certificate after its quality review. Also note that a bridge certificate does not extend inheritability, so if customers inherit your results, plan to republish the recertified assessment promptly. The HITRUST Assessment Handbook sets out the bridge rules, and your assessor should confirm how they apply to your situation.

Who qualifies for an r2 bridge assessment

An r2 bridge assessment is open only when three conditions hold at the same time: the entity holds an r2 certification, the recertification date passed no more than 30 days ago, and no reportable breach or significant change occurred in the period. Check each one before you plan, because failing any single condition removes the bridge option.

Confirm a current r2 holder status

The bridge is open only to organizations that hold an r2 certification, so e1 and i1 holders cannot use it. Check the status of the certification in MyCSF and on the public listing, and confirm the report date and expiry date match your records. Note that the 24-month validity is counted from the report date, which is the date you must track against the 30-day window.

Count the 30-day window

The bridge opens only if you are no more than 30 days past the recertification date. Calculate that date from the report date of your current r2, not from the date your team last looked at the calendar. If the window closes before the bridge assessment can be scheduled and started, the option is gone, and you are left with a certification gap. Put the last day of the window on the compliance calendar well before the anniversary.

Screen for reportable breaches

A reportable breach during the certification period blocks the bridge. Review the incident log for the full period since the last validated assessment and identify any event that required notification to HITRUST or to a regulator or customer. Ask your assessor to help classify borderline events, and confirm the final determination with HITRUST before you commit to a bridge schedule.

Screen for significant changes

Significant changes such as moving in-scope systems to public cloud, replacing in-scope applications, changing service providers, or completing an acquisition or merger can block the bridge. Review change records, the asset inventory and vendor onboarding logs for the period, and list every change that touches in-scope systems. Describe each change to your assessor early, because the decision on whether it is significant is a matter for HITRUST.

Check the scope and factor answers

A changed factor answer or an altered AI model in an ai1 or ai2 can also count as a significant change. Compare the current scope statement, the factor answers and the system inventory with the versions submitted in your last r2. Any difference that affects what was assessed is a question for your assessor and for HITRUST, so raise it before the bridge is scheduled rather than during fieldwork.

Confirm the decision with your assessor

Only an Authorized HITRUST External Assessor organization can perform the bridge assessment, and HITRUST performs quality assurance before a certificate issues. Ask your assessor in writing to confirm eligibility against all three conditions, and ask for the reasoning on any event you flagged. If a breach or significant change occurred, obtain HITRUST's position before you plan a bridge, and keep that correspondence with the assessment file.

How the bridge process runs from expiry to new certificate

The bridge sequence confirms you still qualify, tests a sample of requirements, records your representations and lands a certificate that covers the gap while the full recertification is completed. Each phase produces a specific output you can check before moving on.

Confirm eligibility before expiry passes
Start by checking that your r2 recertification date has not passed by more than 30 days and that no reportable breach or significant change has occurred since your last certification. Your organization owns this check, and the output is a short written record of your recertification date, the days elapsed and any changes since the last report. If either condition fails, a bridge is not available and you need to plan for a full recertification instead. Ask your assessor to confirm eligibility in writing before fieldwork is scheduled.
Engage an authorized External Assessor
Only an Authorized HITRUST External Assessor organization can perform the validated bridge assessment submitted for certification. Your organization contracts directly with the assessor, agrees a written scope and confirms the fieldwork plan. The output is a signed engagement with a named assessor team and an agreed fieldwork window. Confirm the fieldwork window with your assessor, since the supplied guidance caps validated assessment fieldwork at 90 days.
Prepare evidence for the randomly selected requirements
HITRUST selects 19 requirement statements at random for the bridge, and the assessor tests those statements against your current environment. Your team should gather the policies, configuration records, logs and tickets that show each control operating now, not only at the last report date. Partners that prepare systems and evidence can help, but the controls remain yours. The output is an evidence index mapped to the selected statements, ready for the assessor to sample.
Complete bridge fieldwork testing
The assessor tests the 19 selected requirement statements through interviews, document review and sampling, and records the result for each one. Your team answers evidence requests and explains any change since the last validated assessment. The output is a completed fieldwork record with the assessor's findings for every selected statement, including any exceptions that must be addressed before the assessor can close testing. Recording these exceptions early reduces rework in the final stage.
Sign the representation letter
Once fieldwork is complete, your organization signs a representation letter confirming that the information provided to the assessor is accurate and complete. Signing this letter is a condition for the bridge to proceed, and it must be done before the bridge window closes. The output is a signed representation letter held by the assessor and available for HITRUST review. Your legal or compliance lead should review the letter before signature, since it is a formal statement made by your organization.
Submit for HITRUST quality review
The assessor submits the bridge assessment to HITRUST, which performs central quality assurance before issuing any report or certificate. Your organization does not issue the certificate and cannot shortcut this review. The output is HITRUST's acceptance of the submission, or a request for clarification that the assessor must resolve. Ask your assessor to confirm the expected turnaround for this stage, since no review duration is supplied here.
Receive the bridge certificate and plan the full recertification
When HITRUST accepts the bridge, the bridge certificate is valid for 90 days from expiry. The 90 days are deducted from the new r2 certification's 24-month validity, and the 19 tested requirements do not need full retesting in the recertification. The output is the bridge certificate and a dated plan for completing the full recertification within the bridge period. Note that a bridge does not extend inheritability, so republish any inheritable assessments promptly.

What the 19 randomly selected requirements test

The bridge assessment does not retest the full r2 baseline. It tests 19 requirement statements that HITRUST selects at random, and the organization has no say in which ones they are. That makes the bridge a narrow but unpredictable exam: any requirement in the r2 scope can come up, so the preparation has to cover the whole certification rather than a short list of known weak spots. Treat the 19 selections as the only part of the assessment you cannot plan around, and plan everything else around that uncertainty.

The practical response is to keep evidence ready for every one of the 19 assessment domains, from 01 Information Protection Program to 19 Data Protection & Privacy. Before the recertification date, confirm with your assessor that each domain has current, dated evidence that matches the system and population as they exist today, not as they existed at the last assessment. Check that owners can produce it quickly, that screenshots and configuration exports still reflect production, and that any control answered with an alternate or N/A decision still has its supporting record. The question to answer for each domain is simple: if a requirement in this area were selected, could a named person show proof within a day? Gaps found in that exercise are far cheaper to fix now than during a bridge that is already running. Run this check on a regular cadence, not only when a deadline approaches, and record the results in the same system that holds the r2 evidence. If your environment is self-hosted on open-source platforms, confirm that logs, access reviews, change records and backup restore tests are retained long enough to cover the period the assessor will sample. Ask your external assessor which evidence formats they accept and whether they expect a walkthrough per domain. The assessor, not your consultant or implementation partner, decides what is tested and what passes.

How a bridge changes the next certification's dates and inheritance

A bridge certificate does not sit outside the normal certification cycle. The 90 days it covers are taken back out of the next r2 certification, so the new certificate does not restart the full 24-month clock. The 19 requirement statements tested during the bridge also do not need to be retested in the full recertification assessment. Compliance leads should treat this as a scheduling and scope decision, not only as a way to buy time.

Validity is reduced, not reset: The 90 days covered by the bridge come off the new r2's 24-month validity period.
Tested requirements carry forward: The 19 randomly selected requirement statements tested in the bridge need not be retested in the full assessment.
Scope still applies: Only the requirements retested in the bridge are carried forward. Every other requirement remains in the full recertification scope.
Dates change: The new certificate's expiry is calculated from the bridge timeline, so the next interim and renewal dates should be recalculated from HITRUST's dates, not from the original anniversary.

Before submitting, confirm the revised expiry date with your assessor and HITRUST, and record the carried-forward requirements in your assessment file so the next assessor can see what was already tested.

Why e1 and i1 holders have no bridge option

The bridge assessment is defined only for r2 certifications, so e1 and i1 holders cannot use it to cover a late recertification. The cards below explain how the one-year cycle works, what happens at expiry, and what to confirm with your assessor before the calendar slips.

Bridge applies to r2 only

The bridge assessment is an r2 mechanism. It is open only to r2 holders who are no more than 30 days past their recertification date, with no reportable breach or significant change. An e1 or i1 holder with a late recertification has no equivalent path to a bridge certificate, so the planning question is different. Confirm the current eligibility wording in the Assessment Handbook before you rely on it.

Twelve-month validity

e1 and i1 certifications are valid for 12 months from the report date. Recertification fieldwork must be finished, with a signed representation letter, before that date. Because the expiry is short, the full recertification cycle consumes a large share of the year, and the calendar for the next assessment starts earlier than many teams expect.

Gap at expiry

If recertification fieldwork and the signed representation letter are not complete by expiry, the entity has a certification gap. HITRUST does not extend expiration dates, so a late finish cannot be patched by an extension. Treat the expiry date as a hard deadline and plan backwards from it, with the assessor's fieldwork window and internal evidence collection built into the schedule.

Inheritance drops at expiry

An inheritable assessment unpublishes automatically when its certification expires, and a bridge certificate would not extend inheritability anyway. If customers or cloud providers inherit your e1 or i1 results, a late recertification removes those results from their view until you republish. Ask your assessor how to republish quickly, and tell inheriting parties the expected date in advance.

Build the one-year calendar

Plan each e1 or i1 cycle as a single year with fixed milestones: scope confirmation, evidence collection, internal review, assessor fieldwork, and representation letter signature. Work out the latest start date that still finishes before expiry, including time for HITRUST quality assurance. Confirm version rules for the cycle with your assessor, since the CSF version in use can change the requirements.

Confirm rules with your assessor

The rules for e1 and i1 renewal, including rapid recertification options and version transitions, are set out in the Assessment Handbook and can change between releases. Before you commit a date to customers, ask your Authorized External Assessor to confirm the current e1 and i1 path in writing. Record the confirmed rules in your compliance calendar so the answer is not left to memory.

Questions buyers ask about HITRUST bridge assessments

Does a HITRUST r2 bridge assessment cost more than a full recertification?

Usually less in scope, but the price depends on the written scope, not on a fixed rate. A bridge tests 19 randomly selected requirement statements rather than the full r2 assessment, so the testing effort is narrower. The cost components are the assessor's fees for fieldwork and reporting, the internal time your staff spend producing evidence for the selected requirements, and any remediation needed before the bridge starts. Costs rise when several selected requirements have weak evidence, when systems have changed since the last assessment, or when the environment is large. Ask any assessor for a quote that separates assessor fees, your preparation effort and any readiness work, and confirm whether HITRUST assessment fees are billed separately from the assessor's own fees.

How long does a HITRUST bridge assessment take to complete?

The validated assessment fieldwork window is at most 90 days for e1, i1 and r2 assessments, according to HITRUST's Assessment Handbook. That limit sets the maximum period for fieldwork, not the expected duration. Your actual timeline depends on how quickly the assessor can test the randomly selected requirements, how fast your team delivers evidence, and how many follow-up questions arise. Because a bridge certificate covers up to 90 days after expiry, the bridge work needs to start early enough that fieldwork and the signed representation letter can finish inside that period. Confirm the schedule with your assessor in writing before fieldwork begins.

What must an organization provide for a HITRUST bridge assessment?

You must provide evidence for the 19 requirement statements selected for testing, along with the system descriptions and scope details the assessor needs to test them. Expect to supply policies and procedures, configuration records, access reviews, change records, logs and other artifacts that show each control operating. You also need named owners who can answer questions and a current view of any changes since the last assessment. Before the bridge starts, confirm that the bridge is open to you under HITRUST's conditions: the assessment must be taken no more than 30 days past your recertification date, and there must be no reportable breach or significant change. Keep the evidence organized by requirement so the assessor can trace each selected item quickly.

Can our own team run a HITRUST bridge assessment without a consultant?

Your team can prepare evidence, coordinate the assessment and answer assessor questions without an outside consultant, but it cannot perform the validated assessment itself. Only an Authorized HITRUST External Assessor organization can perform a validated assessment submitted for certification, and HITRUST performs quality assurance before issuing reports. Internal staff are best placed to own the control environment, while a consultant or implementation partner can help assemble evidence and fix gaps quickly. Be clear about roles: your organization owns its controls, an implementation partner prepares systems and evidence, and only the authorized assessor and HITRUST issue the report and certificate.

Does a security breach make an organization ineligible for a HITRUST bridge?

Yes, a reportable breach can make your organization ineligible for a bridge. HITRUST opens the bridge only to r2 holders with no reportable breach and no significant change. If a breach has occurred, the path is different, and you should check with HITRUST and your assessor before planning. Significant changes also matter, such as a cloud migration, replacement of an in-scope application, a change of service provider, or a merger. Review your change log against the eligibility conditions early, because discovering a disqualifying event after the recertification date has passed can leave a certification gap.

How does a HITRUST bridge affect customer inheritance of our assessment?

A bridge certificate does not extend inheritability. An inheritable assessment unpublishes automatically when its certification expires, so customers who inherit your results may lose access while the bridge is pending. Plan to republish the recertified assessment promptly once the new certificate is issued. Tell key customers and contract owners about the timeline in advance, so they can plan their own reliance on your results. Ask your assessor how the bridge certificate will be reflected in your HITRUST listings and confirm the republication steps before the certificate date.

Can DeployOpen issue a HITRUST bridge certificate for our organization?

No. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Only an Authorized HITRUST External Assessor organization can perform the validated assessment, and HITRUST performs central quality assurance before issuing the report and certificate. DeployOpen can help you deploy and document the open-source platforms in your own infrastructure, collect evidence for the requirements likely to be selected, and prepare your team for fieldwork. Ask any implementation partner to confirm in writing which parts of the bridge it prepares and which parts the independent assessor performs.

What usually causes a late r2 recertification and how to avoid it

Most r2 recertifications that run late do so for reasons visible months earlier: the calendar, the evidence, the changes and the contracts. The cards below cover the pitfalls we see most often, each paired with a check to run before the interim window opens.

Missing the interim window

The r2 interim assessment is due in the 90 days before the first anniversary of the report date, and a bridge assessment is only open to holders no more than 30 days past their recertification date. Teams that treat the anniversary as a reminder rather than a deadline often find their assessor calendar is full. Put the submission window, the bridge eligibility cutoff and the expiry date in one shared calendar with named owners, and confirm the dates against the HITRUST Assessment Handbook for your certification.

Underestimating evidence across 19 domains

Recertification testing draws on evidence from all 19 assessment domains, not only the ones that changed. Evidence that existed at the last assessment often has gaps in dates, owners or sampled populations that only surface when an assessor asks for them. Build an evidence index that maps each control to its source system, owner and retention location, and run a dry-run pull of samples at least one quarter before fieldwork.

Unplanned significant changes

HITRUST treats changes such as moving from on-premises to public cloud, replacing in-scope applications, changing service providers, and mergers or acquisitions as significant. An unreported change can invalidate the assurance you expected a bridge to carry forward, and it can leave the next assessment scoped against an environment that no longer exists. Keep a standing change log tied to the scope statement, and review it with your assessor before the interim window opens.

Late assessor contracting

Only Authorized HITRUST External Assessor organizations can perform validated assessments submitted for certification. Procurement cycles, conflict checks and scheduling can take longer than the internal preparation itself, and a late contract compresses fieldwork into the last weeks before expiry. Start the assessor selection well before the window, confirm the assessor is on HITRUST's current list, and agree the fieldwork dates in writing with a representation letter date that sits inside your deadline.

Unfinished fieldwork at expiry

The assessor's validated fieldwork window is at most 90 days, and fieldwork must be finished with a signed representation letter by expiry to avoid a certification gap. HITRUST does not extend expiration dates, so a plan that assumes a short slip will be lost. Ask your assessor for a schedule that finishes testing with a buffer before expiry, and decide in advance who signs the representation letter and what happens if a test result is still open.

Inheritable assessments left unpublished

An inheritable assessment unpublishes automatically when its certification expires, and a bridge certificate does not extend inheritability. Customers relying on your inherited controls can lose that reliance while your recertification is still in progress. Once the new certificate is issued, republish the assessment promptly, and tell customers and inheriting parties the date you expect it to be live again.

How DeployOpen prepares evidence ahead of an r2 bridge

A bridge assessment is only as useful as the evidence behind it when HITRUST randomly selects requirement statements to test. DeployOpen prepares the self-hosted platforms, controls and records inside your own infrastructure so your team can present them to your external assessor quickly, while the organization keeps ownership of its controls and the assessor makes the determination.

How we scope

Engagements are fixed-scope, with the systems, environments and requirement areas agreed in writing before work starts.
We confirm your r2 recertification date and the bridge eligibility conditions with your external assessor before planning begins.
Scope documents record which platforms, owners and evidence sources are in play for the 19 randomly selected requirement statements.

How we build

We configure self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks to generate logs and records assessors can sample.
We build evidence collection routines so access reviews, change records and configuration baselines can be produced on request without manual rework.
We run internal testing of the controls in scope so gaps surface before an assessor sees them, and document the results.

How we hand over

You receive written documentation of each control, its owner, its evidence source and the location where that evidence is stored.
We provide an evidence index mapped to HITRUST requirement areas, so your team can answer assessor sample requests directly.
Handover includes runbooks for recurring evidence tasks, so staff can keep records current between the bridge and the next certification.

How we support

Ongoing support, upgrades and continuous testing are available as retainers for organizations that need help between assessment cycles.
Support can cover reviewing certification dates, refreshing evidence after significant changes and keeping inheritable assessments current.
We do not issue reports or certificates. Your external assessor performs the validated assessment and HITRUST issues the outcome.