What does the HITRUST r2 interim assessment test at year one?
An r2 interim assessment must be submitted within the 90 days before the first anniversary of your certification date, and at that checkpoint the assessor fully tests a random selection of requirement statements plus every requirement statement that carries a corrective action plan (CAP). Teams holding a new r2 certificate often treat year one as a light check, but the interim is a real test of controls, and the random sample means any requirement can be pulled in, not only the ones you already know are weak. Your first step is to pull your certification date from MyCSF and calendar the window now, since the assessment is generated and submitted through the platform and the 90-day clock runs from the anniversary, not from when your team is ready.
The division of roles stays the same as in the original validated assessment. Your organization owns its controls and its evidence. An Authorized HITRUST External Assessor organization performs the interim fieldwork, and HITRUST performs central quality assurance before any report is issued. An implementation partner can prepare systems, configurations and evidence packs, but it does not test your controls or issue the outcome. What changes from one organization to the next is the input to the sample: the history of your CAPs, whether you have made significant changes or added systems since certification, and which requirements the random draw happens to select. Ask your assessor early which of these applies to you.
Because the random sample is not known in advance, the practical work is to keep every in-scope requirement audit-ready, not just the CAP items. Check that evidence for each control is current, that the people who operate it can explain it, and that any change since certification is recorded. Confirm with your assessor how they plan to sample, how they will treat CAPs that are still open, and how they will treat changes that were not reported to HITRUST. The outcome of an interim depends on these answers, so get them in writing before fieldwork begins.
How the r2 interim assessment runs from submission window to HITRUST decision
The interim sequence turns a two-year r2 certification into a checked position at year one, with each phase producing a record that the assessor and HITRUST can review before deciding whether the certification stands.
Confirm the certification anniversary and due date
Start by fixing the date your r2 certification was issued, since the interim window is measured from the first anniversary of that date. Your MyCSF record should show the due date. Annual subscribers have the interim generated 90 days before that due date, and you can create it yourself from 120 days out. Confirm the dates with your assessor and HITRUST before you begin, so the window is not missed. The output is a confirmed due date and a named interim owner on your side.
Create the interim assessment in MyCSF
Generate or create the interim assessment in MyCSF, which sets up the interim against your existing r2 results. Review the requirement statements it lists, including the ones carried into the interim because they were required corrective action plans. Your team owns this step, and the output is an interim record that is open and linked to your certification. Check that the record reflects your current scope, since changes to systems or providers affect what is reviewed.
Prepare evidence for the randomly selected requirements
The assessor fully tests a random selection of requirement statements, plus every requirement that had a corrective action plan. You cannot know which statements will be drawn, so the practical step is to keep evidence for all requirements current and retrievable. Map each control to its owner, system and recent artifacts. The output is an evidence index that lets the assessor test any selected statement without a long search.
Complete assessor fieldwork within the 90-day window
The external assessor performs the interim fieldwork within the validated assessment window of at most 90 days. The assessor samples evidence, interviews staff and tests the selected requirements against the CSF. Your team answers requests, provides access and records open questions. Only an Authorized HITRUST External Assessor can perform this work. The output is the assessor's working results for each tested requirement, which are not yet a HITRUST decision.
Answer the significant change and breach questions
The interim asks whether significant changes have occurred since certification and whether any reportable breaches have taken place. Significant changes can include cloud moves, new systems, provider changes or mergers, and they may require re-assessing affected requirements. Gather your change records, incident log and any HITRUST notifications before answering. The output is a written response on each question, backed by records, that the assessor can verify.
Demonstrate corrective action plan progress
The assessor reviews progress on each required corrective action plan. Barring extenuating circumstances, at least 50% of required CAPs must be started or complete. Project plans or tickets alone do not count. Meeting minutes, draft documents, or configuration changes supported by change records can count as evidence. A completed CAP must also meet the 90-day incubation rule. The output is a CAP status file showing which items are started, complete or still open, with evidence for each.
Submit the interim and receive HITRUST's decision
The assessor submits the interim through MyCSF within the 90 days before the first anniversary. HITRUST reviews the submission and decides whether the entity continues to meet the requirements. If HITRUST concludes that it no longer does, it asks the entity to remove references to its HITRUST certification from its literature and website. Confirm the outcome in writing and update any customer-facing material accordingly. The output is HITRUST's decision, which determines whether the r2 certification continues into its second year.
Which requirements get retested at year one
The r2 interim does not repeat the full assessment. It concentrates on two groups of requirement statements, and the assessor looks at each group with different evidence. Understanding both groups before the interim window opens is the most practical way to prepare.
Randomly selected requirement statements
The assessor draws a random selection of requirement statements from the original r2 and tests each one fully again, as if the assessment were new. A clean original result does not carry this group forward automatically, because the population is redrawn and the evidence must reflect the environment as it stands now. Check that every control in scope still has current configuration records, access reviews and logs that match the systems in use today.
CAP-required requirement statements
Any requirement that carried a corrective action plan at the original assessment is tested in full at interim, with no sampling. Each one needs proof that the remediation actually happened and that it has held. Gather the closure evidence for every CAP item, including the change records and the operating evidence that follows the fix.
Why a clean original does not guarantee a clean interim
Controls drift after certification. A new administrator account, a retired logging pipeline or an application moved to a new hosting model can break a control that passed twelve months earlier. Because the random selection changes, a requirement that was never tested before can be the one that fails. Run an internal check of the full r2 population, not only the items you remember.
Evidence the assessor asks for on sampled items
For sampled statements, expect requests for the policy or procedure in force, a sample of operating records across the period since the last assessment, and proof that the control applied to the in-scope systems. Screenshots of settings alone are rarely enough, so keep exports, tickets and logs that show the control working over time. Confirm the exact sampling and evidence rules with your assessor before fieldwork starts.
Evidence the assessor asks for on CAP items
For CAP-required statements, the assessor checks progress against the rules HITRUST sets: project plans or tickets alone do not count, while meeting minutes, draft documents, or configuration changes backed by change records can. A completed CAP must also have met the 90-day incubation rule. Keep a dated record that links each remediation step to the evidence that proves it.
How CAP progress is judged at the interim
At the r2 interim, the assessor checks whether the organization has made real progress on its corrective action plans (CAPs). The working rule is that, barring extenuating circumstances, at least 50% of the required CAPs must be started or complete. Required CAPs are the ones HITRUST flagged in the original validated assessment, so the first task is to pull that list from the prior report and count how many items are open, in progress or closed. Confirm the exact denominator with your assessor before the fieldwork window opens, because a CAP that was closed but later reopened may be counted differently.
Evidence matters as much as the count. Project plans, roadmaps and tickets alone do not count as progress. What does count is evidence that work actually happened: meeting minutes that record decisions and owners, draft policies or procedures that carry a revision history, and configuration changes backed by change records that show who approved them and when. Build a CAP evidence folder for each item now, and make sure each entry points to an artifact the assessor can inspect rather than a status field someone updated.
A CAP that you report as complete must also satisfy the 90-day incubation rule. The control must have operated for the required period, so a fix deployed a few weeks before the interim submission will not qualify on its own. Ask your assessor how the incubation period applies to each CAP you intend to close, and avoid marking items complete if the operating evidence does not yet span that window. Where a CAP cannot reach the threshold in time, document the reason and the revised date now, since extenuating circumstances are judged on the record you can show.
What the change and breach questions ask you to disclose
When nothing material has changed since certification, the interim answer is straightforward, but it still has to be accurate and supportable. The assessor asks whether significant changes have occurred and expects a clear answer for the full period since the certification date. A plain "no" is only credible when the organization can show how it reached that conclusion.
- Review the full period: Check every change from the certification date forward, not only the changes you remember.
- Keep a change log: Record infrastructure, application, provider and ownership changes with dates, even when you judge them insignificant.
- Document the judgment: Write down why each change did not meet HITRUST's definition of significant.
- Align with the scope statement: Confirm that systems in use still match the systems named in the certified scope.
- Brief the signatory: The person who attests to the answers should know what was reviewed and how.
Confirm the definition of significant change against the current Assessment Handbook before you answer, and ask your assessor how they expect the review to be evidenced.
A significant change is one that HITRUST expects you to report, and it may require re-assessing the requirements it affects. The interim is the point where the assessor checks whether those notifications were made and whether the affected requirements still hold. Changes not reported before the interim can become findings, so the timing of notification matters as much as the change itself.
- Identify affected requirements: Map each change to the requirement statements it could affect, such as access, logging or encryption.
- Confirm notification: Check that HITRUST was told of each significant change and keep the submission record.
- Plan re-assessment: Expect that some affected requirements may need to be tested again rather than carried forward.
- Retain change records: Keep tickets, approvals and configuration evidence that show when and how each change took effect.
- Update the system description: Reflect changed components in the scope narrative so the assessor reads a current picture.
Ask HITRUST or your assessor which of your known changes they would treat as significant before the fieldwork window opens.
Adding new systems is treated as a scope expansion, not a routine change. A new system that handles in-scope data generally needs its own validated assessment before it can be certified, although it may be able to inherit results from the existing assessment where the controls are shared. The interim question is therefore about whether the scope has grown and whether that growth has been handled through the correct route.
- List every addition: Record each new application, environment, data store or hosting location brought into the in-scope environment.
- Decide inheritance early: Check whether the new system can inherit controls from the existing assessment or needs its own testing.
- Plan the new validated assessment: Treat certification of the expanded scope as separate work with its own schedule.
- Avoid silent expansion: A system added without notice can leave certified statements that no longer describe the environment.
- Reconcile the inventory: Match the asset inventory against the certified scope before submitting the interim.
Illustrative example: a team that moves a new claims tool into the same cloud account should ask whether that tool sits inside the certified boundary before the interim is submitted.
Reportable breaches are the second disclosure area, and they can affect the certification even when the rest of the environment is unchanged. The interim asks whether any reportable breach has occurred during the certification period and how it was handled. Honest, complete answers matter, because an undisclosed breach discovered later creates a bigger problem than the breach itself.
- Know the reporting threshold: Confirm with HITRUST what counts as a reportable breach under the current handbook.
- Gather the incident record: Collect detection dates, containment steps, notifications and root cause analysis.
- Track remediation: Show that corrective actions were completed and tested, not just planned.
- Check related CAPs: Link any breach to affected corrective action plans, since breach-related gaps can affect CAP progress.
- Involve legal and privacy teams: Agree the wording of the disclosure before it is submitted.
For the consequences and the re-certification route after a breach, consult the dedicated HITRUST breach guidance and confirm the details with your assessor.
What happens if HITRUST is not satisfied after the interim
An r2 interim is a checkpoint, not a formality, and a failed or disputed result changes what an organization may say about its certification. The cards below cover the outcome itself, the remediation questions to settle with HITRUST, and the knock-on effects on customers and contracts.
Removing certification references
If HITRUST concludes after an interim that the entity no longer meets the requirements, it asks the entity to remove references to its HITRUST certification from its literature and website. This applies to sales decks, security questionnaire answers, trust center pages and procurement portals. Before the interim, list every place the certification is cited, so the removal can be carried out completely and quickly once HITRUST makes its request.
Confirming the remediation path
Ask HITRUST in writing what remediation routes exist once an interim has gone against the entity, how much time is allowed for corrective work, and whether a further validated assessment is required before any certification status can be restored. Get the answers before the interim window opens, because the options available depend on the specific findings and on the status of the certificate at that point.
Tracing customer and contract effects
Map every customer agreement, contract clause and due diligence commitment that names the HITRUST certification. Some contracts require a current certification as a condition of service, and others only require a notice period when status changes. Legal and account teams should agree on the notice wording and the customer communications plan before any outcome is known, so the response is consistent across accounts.
Protecting inherited reliance
Other organizations may inherit controls from an entity's HITRUST results, so a change in status can affect their own assessments and reports. Identify which customers or partners currently rely on the certification for inheritance or shared responsibility, and confirm with HITRUST how a status change would be recorded in the public registry and in any reports already issued. Prepare a short factual statement that explains the change without characterizing the cause.
Keeping an evidence trail for the dispute
Whatever the outcome, retain the interim submission, the CAP records, meeting minutes, change tickets and correspondence with the assessor and HITRUST. Ask the external assessor how it documented each finding and what HITRUST reviewed during quality assurance. A clear record shortens any remediation discussion and shows the customer what was tested, what was found and what was corrected.
Who owns the interim, who prepares it and who issues the result
The organization that holds the HITRUST certification owns the interim assessment in full. It owns the controls being tested, the progress of every corrective action plan (CAP), and every statement made about significant changes and reportable breaches. An external party can help prepare, but no one else can attest to what happened inside the environment, so the organization must be able to answer the assessor's questions directly and show current evidence.
- Control ownership: Named owners for each requirement statement stay accountable for operating the control between the certification date and the interim fieldwork.
- CAP progress: The organization decides which CAPs are started or complete and must hold the records that prove it, since at least 50% of required CAPs must be started or complete barring extenuating circumstances.
- Change and breach disclosures: Significant changes and reportable breaches must be identified and reported by the organization, not inferred by the assessor.
- Submission in MyCSF: The organization submits the interim within the 90-day window before the first anniversary, so someone with authority must own that date.
- Post-result actions: If HITRUST concludes the entity no longer meets requirements, the organization must remove references to its certification from literature and its website.
Confirm that your internal owners understand the submission window and that CAP records are kept in a form an assessor can review.
An implementation partner such as DeployOpen can prepare the systems, evidence and CAP documentation that the interim depends on. Preparation is not validation. The partner does not decide whether a requirement is met, does not perform the validated assessment, and does not submit or certify the result. Its work is scoped in writing before it starts, so the boundaries of what it touches are clear.
- Systems and configuration: Hardening, logging and access controls on self-hosted open-source platforms inside the client's own infrastructure, so the operating evidence exists when the assessor asks for it.
- Evidence packaging: Organizing change records, configuration snapshots, meeting minutes and draft documents so each requirement statement can be traced to its evidence.
- CAP documentation: Helping the team write progress records that meet HITRUST's rules, such as meeting minutes or configuration changes with change records, rather than project plans or tickets alone.
- Team support: Preparing staff for assessor interviews and walkthroughs, and running internal checks before fieldwork begins.
- Limits of the role: The partner issues no reports or certificates and cannot stand in for the organization's own attestations.
Confirm the scope, deliverables and written boundaries of any partner engagement before work starts, and check that the partner has no role in deciding the assessment outcome.
Only an Authorized HITRUST External Assessor organization may perform the validated assessment submitted for certification. In the r2 interim, the assessor fully tests a random selection of requirement statements plus all CAP-required ones, asks about significant changes and reportable breaches, and reviews CAP progress. The assessor's fieldwork window for validated assessments is at most 90 days, and the assessor reports its findings to HITRUST.
- Testing scope: A random selection of requirement statements is fully tested, along with every requirement tied to a CAP.
- Inquiry: The assessor asks about significant changes and reportable breaches and checks the organization's answers against evidence.
- CAP review: The assessor checks whether CAP progress meets HITRUST's rules, including the 90-day incubation rule for completed CAPs.
- Independence: The assessor should not be the same firm that prepared the systems or evidence, so confirm independence before engaging.
- Central review: HITRUST performs quality assurance before issuing reports, so the assessor's findings are not final until that review is complete.
Confirm that the assessor is listed as an Authorized HITRUST External Assessor and ask how its independence from your implementation partner is documented.
HITRUST issues the outcome. After the assessor submits its results, HITRUST performs central quality assurance before any report is issued. If HITRUST concludes that the entity no longer meets the requirements, it asks the entity to remove references to its HITRUST certification from its literature and website. Neither the organization nor its partner can make that determination.
- Quality assurance: HITRUST reviews the assessor's work centrally before a report is released.
- Outcome decision: Only HITRUST's review, following the assessor's findings, determines whether the certification continues.
- Adverse conclusion: If requirements are no longer met, the organization must remove certification references from its literature and website.
- Reports: The validated report that customers may rely on comes from this process, not from a consultant's summary.
- Timing: Plan for review time after fieldwork ends, since it follows the assessor's submission.
Confirm with your assessor the expected point at which HITRUST's review is complete and how the final report will be shared with your customers.
Common questions about the r2 interim assessment
When does the r2 interim assessment window open and close?
The interim must be submitted within the 90 days before the first anniversary of your r2 certification date. MyCSF generates the assessment 90 days before the due date for annual subscribers, and those subscribers can also create it from 120 days out. Submitting outside that window is not an option you can plan around, so put the anniversary date on your compliance calendar the day the r2 certificate is issued. Confirm the exact due date and the creation steps with your External Assessor, since the assessor will schedule fieldwork inside a window of at most 90 days.
Is the r2 interim a full reassessment of every requirement?
No. The interim is not a full reassessment. The assessor fully tests a random selection of requirement statements and every requirement statement that has a required corrective action plan (CAP). It also asks about significant changes and reportable breaches and reviews CAP progress. Everything else in your r2 scope is not retested at this point, so your preparation should focus on the sampled statements and the CAP items rather than rebuilding the whole assessment. Because the sample is random, you cannot predict exactly which statements will be tested, so the controls behind every requirement should remain operating and documented.
Do project plans and tickets count as CAP progress?
Project plans or tickets alone do not count as CAP progress. The assessor looks for evidence that the work has actually moved forward, such as meeting minutes, draft documents, or configuration changes supported by change records. A completed CAP must also meet the 90-day incubation rule, so a fix deployed just before the interim will not be accepted as complete on its own. Barring extenuating circumstances, at least 50% of required CAPs must be started or complete. Keep the evidence that shows each step, and agree with your assessor in advance which artifacts will be accepted for each CAP.
What happens to the interim if we made significant changes during the year?
You must notify HITRUST of significant changes, and those changes may require the affected requirements to be re-assessed. Common triggers include cloud migrations, application replacements, changes of service provider, mergers and changes to in-scope factors. Adding new systems is a scope expansion, which needs its own validated assessment before it can be certified, although it may be able to inherit from the existing one. Raise any change you are unsure about with your assessor before the interim is submitted, because an unreported change discovered during fieldwork creates a much larger problem than one reported early.
Can our internal team prepare for the interim without outside help?
Yes, an internal team can prepare the environment, the evidence and the CAP records, but the validated assessment itself must be performed by an Authorized HITRUST External Assessor organization. Your team owns the controls and the evidence, and the assessor owns the testing and the conclusions. An implementation partner can help prepare systems, documentation and evidence collection, but it cannot issue the report or change the assessor's findings. Whether you need outside help depends on how well your evidence is organized today, how many CAPs are open and how many people can maintain the work alongside daily operations.
What drives the effort and cost of an r2 interim?
The main drivers are the number of required CAPs, how many systems and in-scope factors have changed since certification, and how current your evidence is. Teams with few open CAPs and stable systems usually spend less time than teams that have deferred corrective work or made large platform changes. Cost is set by your External Assessor's written scope and quote, so ask for the sampled requirement count, the CAP review effort, the change review and how fieldwork days are estimated. Confirm with your assessor, in writing, what the interim fee includes and what would be billed separately if scope changes during the year.
What happens if HITRUST is not satisfied after the interim?
If HITRUST concludes after an interim that the entity no longer meets the requirements, it asks the entity to remove references to its HITRUST certification from its literature and website. That outcome is serious for customer contracts and procurement, so treat the interim as a real gate, not a formality. Keep CAP progress current throughout the year, reconcile any significant changes early, and make sure your assessor has what it needs before the submission window closes. If you are concerned about the result, speak with your assessor and your legal or contract owner about what your customers must be told.
Does the interim cover the whole certification period?
The r2 certification is valid for two years, and the interim is the checkpoint at the one-year anniversary that keeps it valid into the second year. It does not replace the full validated assessment that renews the certification at the end of that period. Between the interim and the next full assessment, your controls still need to operate and your CAP and change records still need to stay current. Ask your assessor to explain how the interim findings will carry into the renewal planning so the second year does not start with avoidable gaps.
How DeployOpen prepares your systems and evidence for the interim
DeployOpen's part in the interim is preparation, not testing. Under a written fixed scope agreed before work starts, we review which requirement statements your assessor is likely to pull into the interim, including any that carry CAP obligations from your last validated assessment. The scope sets out the systems, the requirement set, the people we will work with and the deliverables, so you know in advance what is being prepared and what is not. Whether your assessor selects a given requirement at random is outside our control, which is why we prepare evidence for the whole in-scope population where practical rather than guessing at the sample.
For each open CAP, we help your team organize the evidence the Handbook recognizes as progress. Project plans and tickets alone do not count, so we focus on artifacts that show the work moving: approved meeting minutes, draft policies and procedures, and configuration changes linked to change records. Where a CAP has been completed, we check that its implementation dates support the 90-day incubation rule, and we flag any gap in dates before the assessor does. We also prepare a short register of significant changes and reportable breaches since certification, so the change and breach questions can be answered from records rather than memory. Your organization owns each control and each answer, and your team signs off on every artifact.
At the end of the work we hand over an evidence package: an index mapped to the requirement statements in scope, the source records for each item, a CAP progress log and a list of open questions for your internal owners. Ask any readiness provider to confirm the format, the review steps and who approves the package before it goes to the assessor. DeployOpen does not perform the interim assessment, does not submit reports to HITRUST and does not issue HITRUST reports or certificates. The independent External Assessor performs the fieldwork, and HITRUST performs quality assurance before any outcome is recorded. We cannot promise an outcome, and the result depends on what the assessor tests and what HITRUST concludes.
