When does a HITRUST shortfall become a corrective action plan?
A corrective action plan (CAP) is required only when a requirement falls below the threshold set for its control reference. Any other shortfall is recorded as a gap. The threshold depends on the assessment type, so the first step before fieldwork is to confirm which assessment you are pursuing and check each shortfall against that assessment's rule, not against a general sense of how serious it looks. For e1 and i1 assessments, a CAP is required for each core requirement scoring below fully compliant whose control reference averages below 80. Shortfalls in references averaging 80 or more are recorded as gaps, as set out in section 13.9.1 of the HITRUST Assessment Handbook.
For r2 assessments, the rule is stricter in some respects and narrower in others. A CAP is required when a requirement scores below 71, its Implemented level is below fully compliant, and its control reference is required for certification and averages below 71 (Handbook 13.9.2). Each condition must hold, so a low score alone does not trigger a CAP. Your readiness work should therefore produce, for every requirement, the score, the Implemented level, the reference average and whether the reference is required for certification. Those four values decide whether a finding becomes a CAP or a gap.
Your organization owns the controls and the evidence behind them. The external assessor, who must be an Authorized HITRUST External Assessor, applies these rules and determines the outcome, and HITRUST performs quality assurance before any report is issued. Treat your internal scoring as a forecast only. Ask your assessor to walk through the calculation for each shortfall before the assessment closes, and confirm which assessment version and rules apply to your engagement, since the handbook and CSF version in use govern the outcome.
How the CAP decision is made, requirement by requirement
The assessor works through each shortfall in a fixed order, so every requirement statement that falls short ends up recorded as either a corrective action plan (CAP) or a gap. The sequence depends on the assessment type, and the assessor makes the final call before HITRUST reviews the results.
Confirm the requirement scores below fully compliant
The assessor starts with each requirement statement and checks its score. A requirement that reaches fully compliant creates no CAP and no gap. Anything below fully compliant moves to the threshold checks that follow. The organization should expect the assessor to list every shortfall at this stage, including items the team considers minor, so that nothing is decided informally. The output is a list of candidate shortfalls for the assessment type in question.
Check the control reference average for e1 and i1
For e1 and i1 assessments, the assessor averages the scores of the control references behind each shortfalled requirement. If that average is below 80, the shortfall is a CAP-required item. If the average is 80 or higher, the shortfall is recorded as a gap. The organization owns the underlying controls, but the assessor performs the averaging and records the result in the assessment workpapers.
Check the r2 score, Implemented level and certification requirement
For r2 assessments, the assessor applies three tests together. The requirement score must be below 71, its Implemented level must be below fully compliant, and its control reference must be required for certification with an average below 71. A shortfall that fails any one of these tests is recorded as a gap. Organizations should confirm with their assessor which control references are required for certification before fieldwork begins, since that status determines whether a CAP is possible at all.
Record the CAP-required item with its plan elements
Each item that passes the applicable test becomes a CAP-required item. The organization then documents a corrective action plan for it, with a specific and measurable action, a status, a named owner and a scheduled completion date. The assessor checks that each element is present. An entry without a measurable action or an accountable owner does not satisfy the record, so the assessor will ask for it to be completed before the assessment proceeds.
Record the remaining shortfalls as gaps
Every shortfall that did not trigger a CAP is recorded as a gap. Gaps are reported in the assessment results but do not carry the CAP elements or the progress checks that apply later. The assessor documents the threshold result for each gap, so a reader of the report can see why the item did not require a CAP. The output is a complete list of gaps alongside the CAP-required items.
Decide whether to accept risk on eligible CAP items
Where a CAP-required item scores 62 or higher, the organization may accept the risk instead of completing the CAP, provided it documents a risk analysis. The assessor reviews that analysis and decides whether it is acceptable. Because this decision is made in the assessment process, the organization should prepare the analysis before fieldwork rather than during it. The output is either a CAP entry or a documented risk acceptance for each eligible item.
Confirm the assessor's final call and HITRUST quality assurance
The assessor, not the organization, makes the final determination of CAP-required items and gaps. Only Authorized HITRUST External Assessor organizations perform validated assessments, and HITRUST performs central quality assurance before any report is issued. The organization should ask the assessor to walk through the threshold results for each shortfall and to confirm that the CAP and gap entries match the workpapers. The closing check is a report that has passed HITRUST quality assurance.
CAP triggers for e1, i1 and r2 compared
The e1 is the lightest of the three validated assessments, and its CAP rule is narrow. A corrective action plan is required for each core requirement that scores below fully compliant and whose control reference averages below 80. A shortfall on a requirement whose control reference averages 80 or more is recorded as a gap instead. The rule applies only to core requirements, so a weak score on a non-core item does not create a CAP by itself.
- Two conditions must both hold: the requirement must be below fully compliant and its control reference must average below 80.
- Gaps still count: a shortfall at or above the reference threshold is recorded and reported, but it does not require a CAP.
- Core requirements only: the trigger is limited to the core requirement set that the e1 baseline defines.
- Averages, not single scores: the control reference average decides the outcome, so one strong reference can offset a weak one.
- Confirm the baseline version: the requirement set changes between CSF versions, so check it in MyCSF for the version you are assessed against.
Before fieldwork, list every core requirement below fully compliant, then calculate the average for each control reference. Any item under the threshold needs a CAP with a named owner and completion date.
The i1 uses the same structure as the e1 for its CAP trigger. A corrective action plan is required for each core requirement scoring below fully compliant whose control reference averages below 80. Shortfalls on references averaging 80 or more are recorded as gaps. Because the i1 contains a much larger requirement set than the e1, the same rule can produce a noticeably longer list of CAP items, so the count should be planned for rather than discovered late.
- Same threshold, larger set: the 80 threshold matches the e1, but the i1 requirement set is considerably larger.
- Core requirements drive the trigger: only core requirements below fully compliant with averages under 80 create CAPs.
- Gaps remain visible: shortfalls at or above 80 are recorded as gaps and appear in the report.
- Do not carry e1 results forward: an e1 with few CAPs does not predict the i1 outcome because the scope and requirement count differ.
- Ask your assessor early: confirm how the reference averages were calculated for your scope items.
Before fieldwork, export the i1 score sheet and filter for core requirements below fully compliant. Then calculate each control reference average and separate the items under 80 from the gaps. Do not assume an i1 CAP list resembles the e1 list.
The r2 uses a lower threshold and a stricter set of conditions. A corrective action plan is required when a requirement scores below 71, its Implemented level is below fully compliant, and its control reference is required for certification and averages below 71. Shortfalls that do not meet all three conditions are recorded as gaps. The r2 is also the only one of the three assessments that carries a CAP progress check into the interim review, which makes the trigger consequential beyond the first certification.
- Three conditions: the requirement score, the Implemented level and the reference average must all fall under their limits.
- Certification-required references: only references the r2 marks as required for certification can trigger a CAP.
- Different threshold: 71 applies here, not 80, so a score that is a gap under the e1 or i1 can become a CAP under the r2.
- Progress is tested later: required CAPs are checked during the r2 interim assessment.
- Gaps do not disappear: non-triggering shortfalls are still reported and should be fixed before the next assessment.
Before fieldwork, do not reuse e1 or i1 thresholds for an r2. Recalculate each reference average against 71, check the Implemented level for each item, and record which CAPs will need evidence of progress before the interim.
Before the fieldwork window opens, reconcile your score sheet against the rule for your assessment type. The three rules share a structure but not their thresholds, so the same raw score can produce different outcomes. The aim is to know, before the assessor does, which items will need a CAP, which will be recorded as gaps, and which may be candidates for documented risk acceptance.
- Identify the assessment type first: apply only the rule for that assessment, not a combined view.
- Check the requirement status: confirm which items are core (e1, i1) or certification-required (r2) and which are below fully compliant.
- Calculate reference averages: compute each control reference average using the threshold for your assessment.
- Mark risk acceptance candidates: items at or above 62 that trigger a CAP may be accepted with a documented risk analysis, so flag them separately.
- Assign owners and dates: each CAP needs a specific, measurable action, status, owner and scheduled completion date.
The score sheet is a working document, so keep the calculation and the version it was built against. Ask your assessor to confirm the rule and the baseline before you finalize the list.
What a corrective action plan must record
Every corrective action plan (CAP) must record four things for each item: a specific, measurable action, a status, an owner and a scheduled completion date. The organization writes these entries and owns them. The independent assessor reviews the plan, tests whether it is credible and reports on it, but the assessor does not draft it for you. Confirm the current field wording in the Assessment Handbook before you build your tracker, since the handbook is the controlling text.
A measurable action names a specific output that someone can inspect later. A vague entry such as "improve access reviews" fails because nobody can tell when it is done. A measurable entry names the system, the population, the frequency and the artifact, for example a quarterly review of privileged accounts in a named directory, with the signed review record as the output. Illustratively, a CAP for log review might name the log sources, the review cadence and the ticket or report that proves each review happened. Status should reflect what has actually occurred, and the owner should be a named role that can answer questions about that item.
The plan must also be credible against the evidence the assessor will sample. If the CAP promises monthly reviews, the assessor will ask for the reviews already performed, and an empty tracker will undermine the entry. Before submission, walk each item to the evidence it implies: the change record, the signed approval, the configuration export or the meeting minutes. Dates should be realistic for the work involved and tied to the assessment timeline, because a completion date that cannot be supported by documented progress invites questions during the r2 interim.
When can a team accept the risk instead of fixing it?
HITRUST allows a CAP-required item that scores 62 or higher to be accepted in place of a corrective action plan, but only with a documented risk analysis. The cards below cover what that analysis must show, who must approve it, what assessors will test, and why accepted risk stays visible in the report.
Confirm the item is eligible
Acceptance applies only where a requirement is CAP-required and scores 62 or higher. Check the score against the assessment's own scoring before anything else, because an item that falls outside the CAP-required conditions for its assessment type cannot use this route. Record the score, the assessment type and the control reference status in the same file as the risk analysis so the assessor can trace the decision back to the scoring.
State the residual risk clearly
The risk analysis must describe the specific weakness, what could go wrong, how likely it is and what it would affect in the organization's environment. A generic statement that risk is low will not satisfy an assessor. Name the systems, data and users involved, and explain why the existing controls leave the remaining exposure at the level the organization accepts.
Name the accountable decision owner
The risk analysis needs a named individual with the authority to accept risk for the affected business area, usually a senior manager or executive who owns the risk, not the team that delivers the control. Record the approval date and confirm that the approver understood the consequences. Confirm with your assessor which titles they will accept as decision owners before the fieldwork window opens.
Document compensating controls
Assessors will look for what reduces the exposure while the weakness remains. Examples include monitoring, manual review, network restrictions or narrowed access. Describe each compensating control, who operates it and how the organization would detect that it had stopped working. Controls described but not operating during the assessment period are weak support for an acceptance decision.
Expect challenge on reasoning
Assessors commonly test whether the rationale is consistent with the score, whether the acceptance is repeated year after year without a plan to fix the item, and whether the cost or effort argument is backed by evidence. Prepare to show how the decision was reviewed, when it will be reviewed next and what would cause the organization to reverse it.
Keep accepted items in the report
Accepting risk does not remove the requirement from the assessment or change its score. The item still appears in the report with its result, and relying parties reading the certification will see it. Treat acceptance as a documented decision the organization must defend, not a way to make a result disappear from the report or from customer questionnaires.
How often CAPs appear in HITRUST assessments
Plan on corrective action plans for r2 and i1 work unless your readiness review shows otherwise. In 2024, HITRUST reported that 88.5% of i1 validated assessments and 68.6% of r2 validated assessments had at least one CAP, compared with 26.5% of e1 assessments. These are averages across assessments HITRUST received that year, not predictions for your organization. They do mean that a team preparing an i1 or r2 should budget time for CAP drafting, owner assignment and progress evidence from the start, rather than treating a CAP as an unlikely exception that appears only after fieldwork begins.
The e1 figure is much lower, which fits the e1 threshold logic: CAPs there apply only to core requirements scoring below fully compliant whose control reference averages below 80. For an e1 team, the planning question is whether any requirement sits near that line. Before fieldwork, ask your assessor or readiness partner to walk through the scoring of each core requirement and identify which control references average below 80, since those are the only items that would trigger a CAP.
HITRUST also reports that repeat customers had 32% fewer CAPs on average in their next r2 assessment and 54% fewer in their next i1 assessment. The likely reason is that the first assessment surfaces weak areas that the second one addresses before fieldwork. Treat that finding as a planning signal, not a guarantee: if this is your first HITRUST assessment, build the CAP register and evidence trail as if you will need it, and confirm with your assessor which items would have needed CAPs in your prior assessment so the next cycle starts from known gaps.
How the r2 interim checks CAP progress
The r2 interim tests a sample of requirements, confirms that the CAP-required items were addressed, and checks whether the organization is making real progress on the corrective action plans it committed to in the original assessment. It falls within the 90 days before the first anniversary of certification, and its output is the assessor's interim report.
Confirm the interim window and assessor
The interim assessment is due in the 90 days before the first anniversary of the r2 certification. Confirm the window early, and confirm that the interim is performed by an Authorized HITRUST External Assessor organization, since only those firms perform validated assessments submitted for certification. Your team owns the schedule and the assessor relationship. Done means a dated engagement with an assessor and a current list of every CAP from the original report, including its owner and scheduled completion date.
Assemble the CAP register and evidence
Before fieldwork starts, gather the CAP register from the original assessment. Each entry should show its specific, measurable action, status, owner and scheduled completion date. For each open or completed CAP, collect the evidence that shows real progress, such as meeting minutes, draft documents, or configuration changes backed by change records. Project plans and tickets alone will not be accepted as progress. Done means each CAP has a file of evidence that the assessor can review without asking for basic context.
Disclose significant changes and reportable breaches
The assessor asks about significant changes to the environment in scope and about any reportable breaches since the last assessment. Prepare a written summary of changes such as new systems, reorganizations, or material shifts in the scoped services, and state whether any security incident met a reportable threshold. Your security and legal leads own the accuracy of this disclosure. Done means the assessor has a complete, dated account that matches the change and incident records.
Test a random sample of requirements
The assessor fully tests a random selection of requirement statements from the r2 baseline, drawn independently of the CAPs. Your team supplies the evidence for each sampled statement, and the assessor tests it at the same depth used for a full validated assessment. Your team owns the evidence quality. Done means each sampled statement has evidence the assessor has tested and recorded, with any exceptions documented.
Fully test every CAP-required requirement
Alongside the random sample, the assessor fully tests every requirement that required a CAP in the original assessment. This step checks whether the corrective work now meets the requirement as written, not just whether a plan exists. Expect the assessor to ask for the same evidence it would accept for a first-time test. Done means each CAP-required requirement has a tested result that either shows the gap is closed or identifies what remains open.
Review CAP progress against the 50% expectation
The assessor reviews the status of every required CAP. Barring extenuating circumstances, at least 50% of the required CAPs must be started or complete at the interim. Completed CAPs must also meet the 90-day incubation rule. Confirm before fieldwork ends which CAPs are complete, which are in progress, and which have not started, and prepare a written explanation for any CAP that is behind schedule. Done means the assessor has recorded the status of each CAP and whether the 50% expectation is met.
Receive and act on the interim report
The assessor issues the interim report, which records the test results, the CAP status review and any findings. HITRUST performs its own quality review before the report is finalized. Your team reviews every finding, assigns owners to open items, and updates the CAP register to reflect the report. Confirm with the assessor and with your own compliance lead what the report means for the certification status. Done means the interim report is in your records and open findings have owners and dates.
What counts as evidence that a CAP is progressing
A corrective action plan is judged on what has actually changed, not on how well it is planned. The cards below cover the artifacts an assessor accepts as progress, the one that does not count, and the incubation rule a completed CAP must also meet, so the organization can keep every item ready for sampling.
Project plans and tickets do not count
A project plan, a Jira or ServiceNow ticket, or a timeline on a slide shows intent, not progress. Assessors treat these as planning records only. Before the r2 interim, check that each CAP-required item has at least one artifact that shows the control was changed, drafted or decided, and not just scheduled.
Meeting minutes with decisions
Minutes count when they record a decision, an owner, and the action taken, such as approving a revised access review procedure or assigning a log source to a SIEM onboarding task. Attendance lists and agendas alone do not show progress. Keep minutes dated and tied to the specific CAP item they support.
Draft documents with version history
Draft policies, procedures and standards can show progress when they are versioned, reviewed and mapped to the requirement they address. A draft that sits unchanged in a folder carries little weight. Keep the version history, reviewer comments and the date each draft was circulated so the assessor can see movement over time.
Configuration changes with change records
A configuration change is strong evidence when the change record shows what was altered, why, who approved it and when it went live. Examples include enabling MFA on a privileged group or turning on audit logging for a named system. Confirm that the change record links to the CAP item and that the running configuration still matches it at sampling time.
The 90-day incubation rule
A completed CAP must also satisfy the 90-day incubation rule, which means the new control has to operate for a period before the item is treated as finished. Plan completion dates with this window in mind, and keep operating evidence such as logs, review sign-offs and exception records from the first day the control runs.
Keep artifacts ready for sampling
The assessor may select any CAP item and ask for its evidence, so every artifact needs to be findable, dated and tied to a CAP identifier. Maintain a single register that lists each CAP item, its owner, its status and the artifacts behind it. Confirm the retention period with your assessor, since the register is what makes sampling quick.
Questions teams ask about CAPs before an assessment
Does a gap need to be fixed before the HITRUST report is issued?
A gap is a shortfall that does not trigger a corrective action plan, so it is recorded in the assessment rather than carried as a CAP with a remediation schedule. Whether a shortfall is a gap or a CAP depends on the score and the control reference average, not on how quickly the team wants to fix it. The Handbook sets separate thresholds for e1 and i1 (references averaging below 80 need a CAP) and r2 (scores below 71 with a required control reference averaging below 71 need a CAP). Teams should confirm with their External Assessor which items are CAP-required and which are gaps before fieldwork starts, because the classification changes the work needed. Your assessor and HITRUST decide what appears in the report; the organization owns the controls and any remediation it chooses to do.
Can a corrective action plan be closed before the assessment ends?
Yes, a CAP can be completed during the assessment window, but it still has to meet the evidence and timing rules. A completed CAP must also satisfy the 90-day incubation rule, so a control changed late in the window may not yet show the operating history the assessor needs. Project plans and tickets alone do not count as progress. Meeting minutes, draft documents, or configuration changes backed by change records can count. Ask the assessor, early in planning, how they will evidence a CAP closed mid-assessment and whether the incubation period applies to your specific change.
Who must sign off a risk acceptance instead of a CAP?
The organization's own accountable leadership must approve the risk acceptance, and the decision must be documented with a risk analysis. Under the Handbook, where a CAP-required item scores 62 or higher, the entity may accept the risk instead of carrying a CAP, provided the documented analysis supports it. The approver should be someone with authority over the risk, such as the executive who owns the business process or the information security risk owner named in your risk governance. Confirm with your assessor what form the sign-off must take and whether they will review the rationale during fieldwork, since an assessor cannot accept risk on your behalf.
Is a corrective action plan needed when a control is inherited?
Whether a CAP is needed depends on how the inherited control is scored and whether the reliance is documented. When a cloud provider, vendor or prior assessment supports a control, the scoring and any shortfall still follow the same rules, so a weak inherited control can still trigger a CAP for your organization. The shared responsibility split matters: you need evidence for the parts you own, and the provider's results must cover the scope you rely on. Confirm with your assessor how they will treat each inherited control, what documentation of reliance they require, and whether any shortfall sits with the provider or with you.
How much internal effort does CAP tracking take, and what drives it?
Tracking effort is driven mainly by the number of CAP-required items, how many owners they span, and how well each item has been defined. Each CAP needs a specific, measurable action, a status, an owner and a scheduled completion date, and these must be kept current through the assessment and into the r2 interim if one applies. Items with vague actions or shared ownership take the most follow-up. HITRUST's 2025 Trust Report found that repeat customers had 32% fewer CAPs on average in their next r2 assessment and 54% fewer in their next i1 assessment, which suggests that fixing root causes early reduces the tracking load over time. Ask your assessor how many CAP-required items they expect, and estimate internal hours from that count and your number of owners.
Can an implementation partner help with CAP remediation?
An implementation partner can prepare systems, configurations and evidence that address CAP items, but it cannot issue the report or decide the score. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, so work on logging, access control, backups or configuration baselines can be scoped in writing before it starts. The organization still owns each control, its owner and its risk decisions, and the independent External Assessor and HITRUST determine the outcome. Most engagements are fixed-scope, so ask for a written scope that names which CAP items are covered, which evidence is delivered, and which items remain with your team.
Who owns CAPs, who can help and who decides
The organization owns its corrective action plans. It writes each CAP, assigns an owner, sets the scheduled completion date, funds the work and records progress. A CAP is only as credible as the organization's own commitment to it, so the people who run the affected systems and processes should be named in the plan, not a consultant or a single security lead acting alone. Before work starts, decide which CAP-required requirement statements sit with which owners, and confirm that each owner has the budget and authority to deliver the action.
An implementation partner such as DeployOpen can help the organization fix the technical gaps behind a CAP, for example by configuring logging, hardening endpoints or preparing access review evidence on self-hosted platforms inside the client's own environment. The partner can also help assemble the evidence an assessor will sample. It cannot decide whether a CAP is complete, whether a risk may be accepted or how a requirement is scored. Keep that boundary explicit in the statement of work. Where the same firm designs a fix, implements it and then tests it against the requirement, the independence of the result is weakened, so confirm with your assessor in advance whether a particular arrangement is acceptable.
Only an Authorized HITRUST External Assessor determines the scoring and produces the validated report, and HITRUST performs central quality assurance before a report is issued. Ask prospective assessors how they handle CAP evidence, what they need to see in each plan, and whether they will review draft CAPs before the fieldwork window opens. Confirm the assessor's Authorized status on HITRUST's public listing before signing. Any risk acceptance decision remains the organization's, documented in its own risk analysis, and the assessor tests that the documentation exists and is consistent with the scoring.
How DeployOpen helps teams prepare CAP evidence
DeployOpen helps organizations prepare the systems, controls and evidence behind HITRUST corrective action plans, including the work of deciding which items need a CAP and which are only gaps. Our role is preparation: we do not issue HITRUST reports or certifications, and only an Authorized HITRUST External Assessor can perform the validated assessment.
How we scope
- We agree a written scope covering which requirement statements, scope items and assessment types the CAP work addresses.
- We review existing scores with your team to separate CAP-required items from items that are only gaps.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
How we build
- We implement or harden self-hosted open-source platforms in your own cloud, data center or air-gapped environment.
- We configure the logging, access review, change and monitoring records that show a CAP action is underway.
- We test the remediated controls and document each action with a measurable target, status, owner and completion date.
How we hand over
- You receive a CAP register with specific actions, owners, scheduled dates and the evidence each action produced.
- We document how each change was made, including change records, so your assessor can trace progress.
- Your organization keeps ownership of its controls, risk acceptance decisions and any documented risk analysis.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, useful before an r2 interim assessment.
- We help your team prepare evidence for the assessor, but the external assessor performs the validation.
- Ask us to confirm in writing which CAP items, platforms and evidence types are in scope before any work begins.
