How does HITRUST rapid recertification for e1 and i1 work?
An eligible i1 holder in year two can use a rapid assessment that applies rapid sampling to the core i1 requirements and to any compliance factors that add more than 60 requirements, with prior scores rolling forward for the rest if the control environment has not materially degraded. An e1 holder can use a rapid assessment in year two only when a compliance factor adds more than 60 requirements, because e1 core requirements are never eligible for rapid sampling. If your e1 or i1 is nearing its first anniversary, the practical question is whether your own factors and control history make the reduced testing available, and the answer should come from your assessor's eligibility review rather than from assumptions about cost.
The division of work matters here. Your organization owns its controls and the evidence that they operate. An implementation partner can prepare systems, documentation and evidence packages so that the year-one controls are still running and provable at recertification. Only an authorized HITRUST External Assessor performs the validated fieldwork, and HITRUST performs central quality assurance before any report is issued. Neither your consultant nor a tool vendor can issue the certification. Ask any assessor to confirm in writing which requirements they will sample, which scores they will roll forward, and why.
Both e1 and i1 certifications are valid for 12 months from the report date, and HITRUST does not extend expiration dates. If recertification fieldwork is not finished with a signed representation letter by expiry, you have a certification gap, and e1 and i1 do not have the bridge option that r2 has. Plan the recertification calendar backward from the expiry date, and confirm your MyCSF subscription level before fieldwork starts, since rapid assessments require a full subscription. The amount of testing you actually receive depends on your organization's compliance factors, its control environment and any significant changes since the last assessment, so confirm these inputs with your assessor before you commit budget.
Which e1 and i1 holders qualify for HITRUST rapid recertification?
Rapid recertification is not a default for every e1 or i1 holder. Eligibility depends on which assessment you hold and whether your compliance factors add enough requirements to make rapid sampling worthwhile. The four cases below separate the situations where testing can shrink from the ones where a full year-two assessment is still required.
i1 holder in year two
An i1 certification is valid for one year, and in year two an eligible organization may run a lighter i1 rapid assessment that uses rapid sampling. Rapid sampling applies to the core i1 requirements, and prior scores can roll forward for the remainder if the control environment has not materially degraded. Confirm with your External Assessor that your environment has not changed in ways that count as material before you plan around this route.
i1 holder with large compliance factors
Rapid sampling also applies to compliance factors that add more than 60 requirements to the i1 baseline. Where a factor pushes the requirement count past that line, the sampled portion grows and the testing saving becomes more meaningful. Ask your assessor to list which factors you carry and how many requirements each adds, because the saving depends on that count rather than on the certification level alone.
e1 holder with a large compliance factor
An e1 holder may be eligible for an e1 rapid assessment in year two, but the rapid route only reduces testing when a compliance factor adds more than 60 requirements. The e1 core set itself does not qualify, so the saving comes entirely from the factor. Confirm the factor count and the assessor's view in writing before you commit to a reduced scope, since the lighter route still produces a full e1 report.
e1 holder with core requirements only
An e1 holder whose assessment contains only core requirements cannot use rapid sampling. Core requirements are never eligible because the set has 60 or fewer statements, so year-two recertification requires a full e1 assessment. Plan the fieldwork and evidence collection as a complete repeat, and do not assume that an earlier score carries forward unchanged.
What does the rapid sample test, and what rolls forward?
In a year-two rapid i1 assessment, the assessor samples only the core i1 requirements and the requirements added by compliance factors that together exceed 60 statements. Everything else keeps its prior score, provided the control environment has not materially degraded since the last validated assessment. The sampling is the work that changes; the scoring standard does not. For an e1, the picture is narrower: e1 core requirements never qualify for rapid sampling because that set has 60 or fewer statements, so an e1 rapid assessment only reduces testing when a compliance factor adds more than 60 requirements. Confirm the requirement counts for your own scope in MyCSF before you plan testing, since the factors you selected determine whether the reduction exists at all.
The determining question is degradation, and the assessor answers it by looking for evidence that the controls behind the prior scores still operate the same way. Expect scrutiny of major changes to systems in scope, changes of cloud or other service providers, replacement of applications, and changes in the people who own or perform key controls, such as access reviews, change management approvals, vulnerability management and incident response. Before the assessment window opens, pull your change log for the period since the last validated assessment and sort each entry by whether it touched an in-scope system, process or owner. Where a change is material, be ready to show the updated evidence, the revised control design and any retesting you performed, because an unexplained gap is the most likely reason an assessor will fall back to full testing.
Rapid assessments produce the same i1 or e1 report and the same one-year certification as a full assessment. HITRUST does not issue a reduced credential for the rapid route, and the report carries the same scores and the same validity period. The rapid route does require a full MyCSF subscription, and Lite Bundle users must upgrade to at least a Professional subscription before they can use it, so confirm your subscription level early. Ask your external assessor to confirm in writing which requirements they intend to sample, which will roll forward and what evidence they need from you, and check the HITRUST Assessment Handbook for the rules on eligibility.
Full assessment or rapid assessment in year two?
This table compares a full e1 or i1 reassessment with a year-two rapid assessment across eligibility, sampling, roll-forward, subscription, report and certification length. Read each row against your own control environment, and use the last row to decide whether a full assessment is the better fit.
| Factor | Full reassessment | Rapid assessment in year two |
|---|---|---|
| Eligibility | Available to any e1 or i1 holder at renewal | Only where the organization holds a qualifying e1 or i1 and the control environment has not materially degraded |
| What is tested | The full requirement set for the assessment level, sampled under standard rules | Core i1 requirements and compliance factors adding more than 60 requirements, using rapid sampling |
| What rolls forward | Nothing carries forward by default; each requirement is assessed again | Prior scores roll forward for requirements outside the rapid sample, if the environment has not materially degraded |
| e1 specifics | Full e1 testing applies to all 44 requirement statements in v11.9 | e1 core requirements are never eligible for rapid sampling, so savings appear only when a compliance factor adds more than 60 requirements |
| Subscription needed | Standard assessment subscription in MyCSF | A full MyCSF subscription is required; Lite Bundle users must move to at least a Professional subscription |
| Report and certification | Full i1 or e1 report with a one-year certification | Same i1 or e1 report and one-year certification as a full assessment |
| Best fit | Significant changes to systems, providers or cloud hosting since the last assessment, or weak prior scores in several domains | A stable environment with clean prior results, where changes are minor and no move to a higher assessment is planned |
| Moving to a higher assessment | Often the cleaner path, since the higher level needs its own scoring across the wider requirement set | Confirm with the assessor whether prior results still support the step up before choosing this option |
| What to confirm first | Scope changes, new factors and fieldwork timing against the certification expiry date | Whether the control environment has materially degraded and that your MyCSF subscription level qualifies |
How the year-two rapid assessment runs from eligibility to certification
The sequence confirms that the year-two rapid assessment is allowed for the organization, produces the same i1 or e1 report and one-year certification as a full assessment, and keeps the certification from lapsing before the new one is issued.
Confirm eligibility and the expiry date
Start by checking that the current certification is an i1 or e1 that is in its second year and that the organization is eligible for rapid sampling. For an e1, eligibility is narrow: the e1 core requirements are never sampled, so a rapid assessment only reduces testing when a compliance factor adds more than 60 requirements. Record the exact expiry date of the current certification from the report, because e1 and i1 certifications run 12 months from the report date and HITRUST never extends expiration dates. The output is a written eligibility decision with the expiry date on the project calendar.
Confirm a full MyCSF subscription
Confirm that the organization holds a full MyCSF subscription before fieldwork begins. Rapid assessments need a full subscription, so organizations on the Lite Bundle must upgrade to at least a Professional subscription. The owner of the assessment, usually the compliance lead, confirms the subscription tier with the licensing contact and checks that the assessor and internal team can access the assessment object. The output is confirmed access to the assessment in MyCSF at the required tier.
Review the control environment for degradation
Review the controls behind the prior scores to confirm they have not materially degraded since the last assessment. This covers changes to systems, providers, access processes, and any security incidents or control failures during the year. Where the control environment has materially degraded, the prior scores cannot roll forward, and the organization should plan for broader testing. The output is a documented degradation review, signed off by the control owner, that states whether prior scores can roll forward.
Prepare evidence and the change record
Assemble the evidence for the sampled requirements and the rolled-forward areas, and prepare a change record that lists significant changes since the last assessment, such as new systems, cloud moves, or provider changes. Your readiness work is the place to confirm that each requirement has current, dated evidence that an assessor can trace to a control owner. The output is an evidence index and a change record that the assessor can review at the start of fieldwork.
Complete fieldwork with an authorized assessor
An Authorized HITRUST External Assessor performs the rapid validated assessment. Only an authorized assessor can perform validated assessments submitted for certification, and the organization owns its controls while the assessor tests them. Fieldwork must finish within the validated assessment fieldwork window of at most 90 days. The output is the assessor's completed testing workpapers and draft results, with any gaps logged for correction before submission.
Sign the representation letter before expiry
Fieldwork is not complete for recertification until the organization signs a representation letter confirming the accuracy of its responses and evidence. The letter must be in place before the current certification expires. If fieldwork and the signed letter are not complete by expiry, the entity has a certification gap, and HITRUST does not extend expiration dates. Confirm the signing date against the expiry date recorded in the first step. The output is a signed representation letter dated before expiry.
Submit for HITRUST quality assurance
The assessor submits the completed assessment to HITRUST, which performs central quality assurance before any report is issued. Expect questions from HITRUST on sampled evidence or scoring, and respond through the assessor. The organization should track the submission status and keep the evidence available for follow-up. The output is HITRUST's quality assurance acceptance of the submission.
Receive the report and one-year certification
After quality assurance, HITRUST issues the i1 or e1 report and a one-year certification. The rapid assessment produces the same report and certification as a full assessment, so customers and relying parties read it the same way. Check the report date, which starts the new 12-month validity period, and update the expiry date in your records and in any customer reliance materials. The output is the issued report and certificate with a new expiry date.
Who owns the controls, who prepares evidence and who certifies?
The organization holding the certification owns every control, every system in scope and every decision that shapes the certification. Its leadership decides the scope of the rapid assessment, confirms that the control environment has not materially degraded since the last validated assessment, and signs the representation letter that HITRUST requires before a recertification can be completed. Nothing in a rapid assessment removes this accountability, and an assessor will ask the organization, not the partner, to explain how controls operate day to day.
- Control ownership: Named owners maintain each control, its procedures and its operating records throughout the year, not only in the weeks before fieldwork.
- MyCSF subscription: The organization holds the full MyCSF subscription needed for a rapid assessment. Lite Bundle users must upgrade to at least a Professional subscription first.
- Scope decisions: The organization decides which systems, factors and requirements are in scope and documents any change since the prior certification.
- Material degradation review: Internal staff judge whether the control environment has changed in a way that would stop prior scores from rolling forward.
- Representation letter: An authorized signatory signs the representation letter, and recertification fieldwork must finish with that letter in place before the expiry date.
Confirm with your assessor which subscription tier and sign-off roles they expect before scoping begins.
An implementation partner such as DeployOpen helps the organization prepare for the assessment. Work typically covers configuring and hardening the self-hosted open-source platforms in scope, writing control documentation, assembling evidence packages for each requirement, running internal readiness checks and supporting remediation when a control falls short. The partner works inside the organization's own infrastructure and answers to the organization. It does not issue reports, attestations or certificates, and it cannot act as the assessor for the same engagement.
- System preparation: Engineers configure logging, access control, backup and patching on the platforms in scope so that operating evidence exists for the sampling period.
- Control documentation: Procedures and standards are drafted for the organization's review and approval, not adopted on its behalf.
- Evidence packages: Records are organized by requirement so an assessor can trace each statement to its proof.
- Readiness checks and remediation: Internal reviews flag gaps before fieldwork, and the partner helps fix them under a written scope.
- Independence limit: The partner cannot perform the validated assessment, sign results or be the party HITRUST relies on for quality assurance on the same engagement.
Ask any partner to state in writing which tasks they will perform and confirm that they will not be the External Assessor for your recertification.
Only an Authorized HITRUST External Assessor organization can perform the validated assessment that is submitted for certification. The assessor plans the fieldwork, selects samples, tests whether controls operate as described, and records its findings in MyCSF. HITRUST then performs central quality assurance on the submission before it issues the report. The assessor's validated fieldwork window is at most 90 days, so the work must be planned around the expiry date rather than after it.
- Fieldwork: The assessor tests the controls in scope, including the rapid sampling approach for requirements eligible for it.
- Independent testing: The assessor reaches its own conclusions from evidence and interviews rather than relying on the partner's summaries.
- Submission: Results are entered and submitted through MyCSF for HITRUST review.
- Quality assurance: HITRUST reviews the submission centrally before any report or certification is issued.
- Timing: Fieldwork must fit within the 90-day window and finish with the representation letter in place before the certification expires.
Confirm that your chosen assessor appears on HITRUST's list of Authorized External Assessors before signing an engagement letter.
What usually breaks a rapid recertification?
Most failed or lapsed rapid recertifications trace back to a handful of avoidable issues: timing, scope eligibility, subscription status, undocumented change and evidence gaps. Each card below names one risk and a check the team can run before the fieldwork window opens.
Letting the certification expire
Recertification fieldwork must finish, with a signed representation letter, before the current certification expires. If it does not, the entity has a certification gap, and HITRUST does not extend expiration dates. Put the expiry date and the representation letter signing date on one shared calendar, and work back from them to set the assessor's fieldwork start. Confirm the signing owner now, so the letter is not waiting on one executive's availability.
Assuming e1 core requirements qualify
Teams often expect an e1 rapid assessment to cut testing across the board. It does not. The e1 core requirements are never eligible for rapid sampling because the set has 60 or fewer statements, so a rapid e1 reduces testing only when a compliance factor adds more than 60 requirements. Before committing budget, count the requirements your scope adds, and ask the assessor to confirm which ones qualify.
Lapsing on the MyCSF subscription
A rapid assessment requires a full MyCSF subscription. Organizations on a Lite Bundle must upgrade to at least a Professional subscription before the assessment can be created and submitted. Check the subscription tier and its end date during readiness, not after the fieldwork window has opened. Ask the assessor and HITRUST to confirm the entitlement in writing if the subscription is renewed late or changed mid-cycle.
Undocumented control changes
A rapid assessment carries prior scores forward only if the control environment has not materially degraded. Changes to cloud accounts, identity providers, logging pipelines or key vendors that were never recorded can look like degradation when the assessor reviews them. Keep a dated change register for the year, with the reason, approver and evidence for each change. Walk the register with the assessor before fieldwork so that known changes are explained, not discovered.
Evidence gaps in sampled requirements
Rapid sampling picks a subset of requirements to retest, and the sample can land on controls whose evidence is scattered, expired or held by a former employee. A gap in one sampled requirement can fail the review even when the control works. Before the window opens, pull evidence for every core i1 requirement and each factor requirement, check its dates and owner, and confirm that screenshots, tickets and logs cover the full assessment period.
Questions buyers ask about HITRUST rapid recertification
Can every e1 holder use a rapid assessment in year two?
No. An e1 rapid assessment only reduces testing when a compliance factor you have added pushes the requirement count above 60. The e1 core requirements are never eligible for rapid sampling, because that set has 60 or fewer statements, so a plain e1 with no added factors gets no sampling benefit. Before you plan around a rapid assessment, confirm with your External Assessor or HITRUST which requirements in your scope are eligible. If you are not sure whether your e1 is eligible, ask for that determination in writing before you sign an engagement. A rapid assessment is only one route, and a full e1 assessment remains available in year two.
Does a rapid assessment produce a different certificate?
No. A rapid i1 or e1 assessment produces the same report type and the same one-year certification as a full assessment. The lighter testing changes how the evidence is gathered for year two, not what the certificate says. Recipients who read the report will see the same certification level and validity period. Your customers and regulators should therefore be able to rely on it in the same way, but they will still read the report to confirm the scope and any factors included.
What does the organization have to do itself?
The organization owns its controls and must keep them operating throughout the year. In practice, that means maintaining the policies, access reviews, change records, vulnerability management and other evidence that the assessor will sample. You also need an active full MyCSF subscription, since Lite Bundle users must upgrade to at least a Professional subscription before a rapid assessment. Internally, someone must keep the scope current, answer assessor questions and sign the representation letter. Your team should also confirm that the control environment has not materially degraded, because prior scores only roll forward if it has not.
Can an implementation partner run the rapid assessment for us?
No. Only an Authorized HITRUST External Assessor organization can perform a validated assessment submitted for certification, and HITRUST performs central quality assurance before it issues the report. An implementation partner such as DeployOpen can prepare systems, configuration, documentation and evidence before the assessor arrives, and can help your team maintain those artifacts during the year. The partner does not test, score or attest to the controls. Keep that boundary clear in your contracts so that the assessor's independence is not in question.
How does year-two timing work against the 12-month expiry?
Your e1 or i1 certification is valid for 12 months from the report date. If recertification fieldwork is not finished, with a signed representation letter, by expiry, you have a certification gap, and HITRUST never extends expiration dates. Fieldwork for e1, i1 and r2 assessments is limited to at most 90 days, so you should count backward from the expiry date and schedule the assessor, evidence collection and internal review early. Start the planning window well before the anniversary, because the time needed for scoping, evidence gathering and quality assurance is what most often pushes a renewal late.
Is there a bridge certificate if recertification runs late?
No. A bridge option exists for r2 but not for e1 or i1. If your e1 or i1 expires before recertification is complete, there is no bridge certificate to cover the gap, so the plan has to avoid that outcome. Treat the year-two date as a hard deadline, plan the fieldwork window early, and keep evidence current throughout the year so the assessor does not need to rebuild it under time pressure. Ask your assessor to confirm the timetable against your expiry date at the start of the engagement.
What drives the cost of a rapid recertification?
No price is given here, because a quote follows from the written scope. The main cost components are the External Assessor's fees, which cover fieldwork and quality review, the MyCSF subscription your assessment requires, and any internal time or outside help used to maintain evidence. Costs rise with the number of requirements in scope, the number of compliance factors added, the number of systems and locations involved, and how much evidence must be gathered from scratch. Ask any quote to separate assessor fees, subscription charges and implementation work, and to state which parts are one-time and which recur each year.
How DeployOpen prepares your systems and evidence for recertification
DeployOpen works inside your own infrastructure to prepare the systems, controls and evidence that a HITRUST rapid recertification for e1 or i1 will sample and test. We plan the work around the scope you agree in writing, and an authorized HITRUST External Assessor performs the validated assessment and issues any report.
How we scope
- We confirm whether your e1 or i1 is eligible for a rapid assessment in year two and which requirements fall outside rapid sampling.
- We confirm your MyCSF subscription level, since rapid assessments need a full subscription and Lite Bundle users must upgrade.
- We agree the written scope, deliverables and timeline with you before any work starts, because engagements are fixed-scope.
How we build
- We review the existing control environment for material degradation since the last assessment, which determines whether prior scores can roll forward.
- We check the evidence behind the requirements most likely to be sampled, using the same records an assessor would request.
- We close gaps in your open-source platforms, configuration and logging inside your own cloud accounts, data centers or air-gapped networks.
How we hand over
- We document each control's owner, operation and evidence location so your team can produce it on request during fieldwork.
- We hand over a dated evidence index and a control-by-control record of changes made during preparation.
- We confirm with your assessor which items they need before fieldwork, and confirm the recertification date against your certification expiry.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, which keeps evidence current between assessments.
- We can re-check controls that changed after the last report, such as platform upgrades or new systems in scope.
- Final certification decisions, reports and any representation letter remain with your organization and the independent assessor, not DeployOpen.
