HITRUST vs ISO 27001: which to pursue first for healthcare vendors
Both HITRUST and ISO 27001 are certifiable, and the HITRUST CSF is built on ISO/IEC 27001 and 27002, so the first decision is less about which framework is stronger and more about which buyers will demand which proof. A healthcare vendor with US and international customers should start by listing its top ten contract and questionnaire requesters, noting which ones name HITRUST, which name ISO 27001, and which accept either. That list, not general reputation, sets the default path. For most US health customers the default is a HITRUST e1, i1 or r2 assessment, because a HITRUST report is the proof those buyers ask for by name. Where European or other international buyers ask for ISO 27001, the vendor should confirm whether an ISMS certificate from an accredited certification body satisfies them, since ISO does not certify organizations itself and the certification body must be accredited.
A vendor should hold both when a meaningful share of its revenue depends on each buyer type and the two programs can share one control set. The overlap is real but not total: HITRUST harmonizes ISO/IEC 27001 and 27002 with many other sources, while ISO 27001 is judged against its own Annex A controls and a management system with its own audit cycle. The two validity models also differ. HITRUST e1 and i1 certifications last one year and r2 certifications two years, with an r2 interim assessment due in the 90 days before the first anniversary, while an ISO certification runs a three-year cycle with at least one audit in every calendar year. Plan the calendars together before committing. Only Authorized HITRUST External Assessor organizations can perform validated HITRUST assessments, and accredited certification bodies perform ISO audits. DeployOpen prepares systems, controls and evidence for either path but does not issue certificates, reports or attestations; the assessor or certification body does. Ask each to confirm scope, fees and timelines in writing before work starts.
How HITRUST e1, i1, r2 and ISO 27001 differ on the factors buyers compare
This table sets the three HITRUST assessment levels against ISO/IEC 27001 on scope, prescriptiveness, scoring, validity, proof and cost transparency. Read each row as a question to put to both programs, then check the answer against your own customer contracts and the assessor you intend to use.
| Factor | HITRUST e1, i1 and r2 | ISO/IEC 27001:2022 |
|---|---|---|
| Scope of what is assessed | Harmonized CSF control set, with e1, i1 and r2 as tiers of depth. Every e1 requirement sits in i1 and every i1 requirement sits in r2. | An information security management system for the organization, scoped by the organization and checked by the certification body against the standard's requirements. |
| Prescriptiveness | Prescriptive control statements: the CSF has 14 control categories, 49 control objectives and 156 control specifications. | Requirements are set at management system level. Annex A holds 93 reference controls that the organization selects and justifies in its Statement of Applicability. |
| Control count and structure | v11.9 has 44 e1 requirement statements and 182 i1 requirement statements. Results are reported across 19 assessment domains. | Annex A has 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). |
| How results are scored | Maturity scoring. e1 and i1 score the Implemented level and need each domain's core statements to average at least 83. r2 scores policy, procedure and implementation maturity and needs each domain to average at least 62. | Conformity audit. The certification body checks whether the management system meets each requirement and whether the controls chosen are implemented and effective. Nonconformities are raised rather than averaged. |
| Validity and surveillance | e1 and i1 certifications last one year. r2 certifications last two years, with an interim assessment due in the 90 days before the first anniversary. | Three-year certification cycle, with at least one audit in every calendar year, either surveillance or recertification. |
| Who can assess | Only Authorized HITRUST External Assessor organizations perform validated assessments. HITRUST runs central quality assurance before issuing reports. | Accredited certification bodies assess and certify. Confirm accreditation and the current certificate in the IAF CertSearch database. |
| Proof issued | A HITRUST certification and report, issued after HITRUST quality assurance. Confirm the report's scope and validity date with the customer. | A certificate issued by an accredited certification body for the scoped management system. ISO does not certify organizations itself. |
| Edition and amendment status | CSF v11.9.0 is the current version, available in MyCSF from September 24, 2026. Plan assessments against the version your assessor is using. | ISO/IEC 27001:2022 is the current edition. The 2013 certifications had to expire or be withdrawn by 31 October 2025. The 2024 amendment covers climate change and costs CHF 0. |
| Licensing and cost transparency | Assessments are created and submitted in MyCSF through a subscription. HITRUST does not publish prices, so request a written quote from HITRUST and your assessor. | The standard is sold by ISO, with the English PDF and ePub priced at CHF 155 as of October 2026. Certification fees come from the certification body, so request a written quote for the audit scope. |
Which option fits which customer and contract situation
HITRUST matters most when a US payer, provider or health system names HITRUST in its vendor questionnaire, security addendum or contract, usually for systems that create, receive, maintain or transmit electronic protected health information. The proof is a HITRUST e1, i1 or r2 certification report, scored against the HITRUST CSF, with the assessment performed by an Authorized HITRUST External Assessor and reviewed centrally by HITRUST. The e1 and i1 certifications are valid for one year and the r2 for two years with an interim assessment, so the buyer will expect a renewal calendar. Confirm with the buyer which level they require, whether they accept an e1 or i1 for a low-risk service, and whether an inherited or shared assessment from a platform provider satisfies the requirement.
- Level requested: Ask whether the contract names e1, i1 or r2, since the three levels differ in scope, scoring and validity.
- Scope boundary: Confirm which systems, environments and hosting components must sit inside the assessed scope.
- Renewal cadence: Confirm the expiry date and who owns the interim assessment for an r2.
- Inheritance rules: Ask whether the buyer accepts inherited controls from a cloud or hosting provider's certification.
- Other HIPAA evidence: Confirm whether the buyer also wants a risk analysis or a SOC 2 report, since HITRUST does not replace those.
Before committing, get the required level, scope and renewal dates in writing from the buyer's security or procurement team.
ISO/IEC 27001 matters most when an international enterprise, a European or Asia-Pacific buyer, or a multinational procurement team asks for a certified information security management system. The proof is a certificate issued by an accredited certification body, not by ISO itself, and the certification body operates to ISO/IEC 17021-1:2015 with ISO/IEC 27006-1:2024 applied to all clients since 31 March 2026. The management system cycle lasts three years with at least one audit every calendar year, so the buyer will expect surveillance audits between the main assessments. Confirm which certification body the buyer recognizes, which scope of sites and services must be covered and whether the buyer checks the accredited certificate through the IAF CertSearch database.
- Accredited body: Ask which certification body and accreditation the buyer will accept.
- Statement of applicability: Confirm which of the 93 Annex A controls the buyer expects to see justified.
- Scope of sites: Confirm whether the certificate must cover specific locations, business units or services.
- Surveillance schedule: Confirm the audit calendar the buyer expects between recertifications.
- Transition status: Confirm the buyer does not still require a certificate to the superseded 2013 edition, which had to expire by 31 October 2025.
Before committing, confirm the certification body, scope and audit calendar with the buyer's supplier risk team.
Holding both matters when a healthcare vendor sells to US payers and providers that ask for HITRUST and to international enterprises that ask for ISO/IEC 27001. The HITRUST CSF is built on ISO/IEC 27001 and 27002, and the e1, i1 and r2 form a traversable portfolio, so a well-maintained control set can serve both requests. The two proofs still differ: HITRUST produces a scored, time-limited assessment report, while ISO produces a certificate tied to an accredited management system with annual audits. Plan one control set, one evidence repository and two assessment calendars, and confirm with each buyer whether a mapping or cross-reference is acceptable in place of a second assessment.
- Shared control set: Map the Annex A controls to HITRUST control specifications before selecting the assessment path.
- Two calendars: Track the HITRUST validity period alongside the ISO three-year cycle and annual audits.
- Scope alignment: Make sure the HITRUST scope and ISO scope describe the same systems and sites.
- Acceptance of mappings: Ask each buyer whether a cross-mapping counts as evidence or whether a separate certificate is required.
- Certification body choice: Confirm whether the ISO certification body and the HITRUST assessor will both need access to the same evidence.
Before committing to both, confirm with each buyer in writing that the proof they accept covers their contract clauses.
An early-stage vendor with no certification requirement yet usually does not need either certificate on day one. Neither HITRUST nor ISO/IEC 27001 is a legal prerequisite for selling software in most markets, and buyers often accept a self-assessment or questionnaire at first. The practical choice is to build a control set that can later support either certification, rather than to certify early. A HITRUST e1 is a narrower starting point than an i1 or r2, while an ISO scope can be drafted around the management system before any certification body is engaged. Confirm with the first prospects which proof they will ask for when the contract is signed, so the program is not rebuilt under deadline.
- Current demand: Ask the first prospects which questionnaire, report or certificate they will request.
- Control foundation: Build an information security policy set and risk process that map to both frameworks.
- Scope discipline: Keep the production boundary small and documented so later assessments are cheaper to scope.
- Cost timing: Ask certification bodies and HITRUST-authorized assessors for a written quote once scope is fixed, since the fees depend on scope.
- Evidence habits: Start collecting evidence now, because both assessments test operation over time.
Before committing money to either certification, confirm the requirement with at least two named buyers and a written scope.
Who assesses each framework and what each assessment produces
This table compares who performs each assessment, how long a result stays valid and what document the organization receives. Read it to see whether your customers will ask for a HITRUST report, an ISO certificate or both, and how often each one needs a fresh assessment.
| Element | HITRUST e1, i1 and r2 | ISO/IEC 27001:2022 |
|---|---|---|
| Who performs the assessment | Authorized HITRUST External Assessor organizations, with HITRUST performing central quality assurance before issuing a report | Accredited ISMS certification bodies operating to ISO/IEC 17021-1 and ISO/IEC 27006-1. ISO itself does not certify organizations |
| What the organization receives | A HITRUST validated assessment report and certification when results meet the scoring thresholds | A certificate issued by the certification body, which you can check in the IAF CertSearch database |
| Fieldwork window | At most 90 days for the validated assessment fieldwork, for e1, i1 and r2 alike | Set by the certification body's audit plan. Confirm the duration and scope in your written proposal |
| Validity and renewal cycle | e1 and i1 are valid for one year. r2 is valid for two years, with an interim assessment due in the 90 days before the first anniversary | Three-year certification cycle, with at least one surveillance or recertification audit in every calendar year |
| Required ongoing audits | A new assessment is needed to renew e1 and i1 each year. r2 requires the interim assessment between years | Annual audit by the certification body, either surveillance or recertification, under ISO/IEC 17021-1 |
| Quality assurance after fieldwork | HITRUST commits to a 30-day quality assurance service level for e1 and 45 days for i1, per its 2025 Trust Report | Quality review sits with the certification body and its accreditor. Ask the body how it reviews audit files before issuing a certificate |
| Standard that governs the assessor | HITRUST Assessment Handbook and HITRUST's assessor authorization program | ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, which accredited bodies must apply to all clients by 31 March 2026 under IAF MD 29:2024 |
Why HITRUST scoring differs from an ISO conformity audit
HITRUST scores maturity, while an ISO audit tests conformity. The e1 and i1 assessments score the Implemented maturity level, and each domain's core statements must average at least 83. The r2 scores policy, procedure and implementation maturity, and each domain must average at least 62. An ISO/IEC 27001 certification body instead checks whether your information security management system meets the clause requirements and whether the Annex A controls you selected are in place and working as described in your Statement of Applicability. The unit of judgment differs: HITRUST produces a numeric result per domain, while an ISO auditor records conformity or nonconformity against a requirement.
A weak domain drags the HITRUST result down through the average. Because the threshold applies to each domain, a low-scoring domain can fail the certification even when most other domains are strong. Illustratively, a team with strong access controls could still miss the threshold in a domain where its asset and incident processes are only partly implemented, and adding strength elsewhere does not offset that domain. Before you start, read the scoring method in the HITRUST Assessment Handbook and confirm with your External Assessor how each requirement statement is scored in the version you will use.
A nonconformity affects the ISO certificate differently. An ISO auditor raises nonconformities against specific clause or control requirements, and the certification body decides what must be corrected and verified before a certificate is granted or kept. Major and minor findings are handled through the certification body's own process, so the practical question for your team is how many open findings are tolerable and how quickly each must be closed. Neither route is easier: HITRUST asks you to reach a numeric threshold in every domain, and ISO asks you to prove conformity with every applicable requirement and control you claim. Confirm the findings and timelines in writing with your certification body before planning remediation.
Where HITRUST and ISO 27001 work overlaps
HITRUST CSF is built on the core structure of ISO/IEC 27001 and 27002, so much of the control content you build for one can be reused for the other. The overlap is real in the controls, but the management system clauses, HITRUST maturity scoring and assessor evidence still need their own work.
Shared control structure
The CSF's core structure is based on ISO/IEC 27001 and 27002, so a control you can evidence for one framework often maps to a control in the other. This saves work when your ISMS already has a documented Annex A statement of applicability and clear owners. Check each mapping against the current CSF version in MyCSF, because a control that matches by topic may still differ in wording, scope or expected evidence.
Wide source harmonization
HITRUST harmonizes more than 70 authoritative sources, including ISO/IEC 27001, 27002, NIST SP 800-53 Rev. 5, HIPAA, PCI and GDPR. This helps when one customer asks for HITRUST and another asks for ISO 27001, because one evidence set can answer both requests. It does not replace a line-by-line check, since the harmonized wording may not match the ISO clause a certification body will sample.
NIST SP 800-53 alignment
The CSF maps to NIST SP 800-53 Rev. 5, so controls evidenced for a federal or health-sector customer can be traced across the three frameworks. This matters if you serve government-facing buyers alongside ISO customers. Confirm which 800-53 revision and mapping version your target assessment uses, because the CSF refreshes its mapping between releases.
Annex A four-theme structure
ISO/IEC 27001:2022 Annex A groups its 93 controls into organizational, people, physical and technological themes. Sorting your evidence library by these themes lets you reuse artifacts such as access reviews, asset records and physical security logs across both frameworks. Keep in mind that Annex A is only one part of the ISO certification, and the CSF organizes the same ground into its own categories.
ISMS management system clauses
ISO certification requires a working information security management system, including the scope, risk assessment and treatment, internal audit and management review clauses. These are not replaced by control mapping, so a HITRUST assessment will not give you the ISMS evidence a certification body samples. Plan separate records for management review minutes, internal audit programs and the statement of applicability.
HITRUST maturity scoring
HITRUST scores maturity across 19 assessment domains and sets thresholds for e1, i1 and r2, which ISO does not use. If your controls are in place but operate unevenly, the HITRUST score will show gaps that an ISO audit may treat differently. Ask your assessor how its scoring applies to your environment before you assume a control mapped from ISO will pass HITRUST.
Doing both: order of work and how to share evidence
A vendor holding both certificates should sequence the work so that one evidence library feeds the HITRUST assessment and the ISO audit, rather than producing two parallel sets of records. The order below starts with buyer requirements and ends with a scheduled ISO certification audit.
Confirm which buyers require which proof
Start by listing each customer, contract and regulator that asks for a certificate, and record which one they name: a HITRUST e1, i1 or r2 certification, an ISO/IEC 27001 certificate, or a report they will accept as an alternative. Involve sales, legal and the compliance lead, because contract wording often decides the order. The step is done when every requirement is tied to a named framework and an assessment level, and the list is signed off by the CISO. Where a buyer's wording is unclear, ask them to confirm in writing which scope and level they mean before any scoping work begins.
Build one control evidence library
Create a single register of controls, owners, policies, procedures, configuration exports, logs and review records, and map each item to the ISO/IEC 27001:2022 Annex A control it supports and to the HITRUST control specification it supports. Because the HITRUST CSF is built on ISO/IEC 27001 and 27002, many items will map to both, but the mapping must be checked line by line rather than assumed. The output is a mapping workbook that names the owner of each evidence item and its review date. Confirm the mapping with the HITRUST and ISO scoping documents in your own environment before relying on it.
Check evidence against the current HITRUST version
Before any evidence is reused, check it against the current CSF release. HITRUST CSF v11.9.0 is the current version, available in MyCSF from September 24, 2026. It refreshed the NIST SP 800-53 Rev. 5.2.0 mapping and changed the e1 and i1 baselines, so items mapped to older requirement statements may no longer match. Note which items changed, retire or update the affected mappings, and record the version each item was checked against. The step is complete when the library states the CSF version it was validated to and each changed requirement has a documented disposition.
Complete the ISMS management system work
Work through the ISMS requirements in ISO/IEC 27001:2022, including scope, risk assessment and risk treatment, statement of applicability, management review and internal audit. These records are the management system proof that an ISO certification body will examine, and they are not something the HITRUST assessment replaces. The output is a documented ISMS with a statement of applicability that justifies each Annex A control. Confirm with the planned certification body which documents it will sample and how it expects the statement of applicability to be formatted.
Run the HITRUST assessment in MyCSF
Create, scope and submit the HITRUST assessment in MyCSF, which requires a subscription, and select the e1, i1 or r2 level that the confirmed buyer requirements call for. Only an Authorized HITRUST External Assessor organization can perform the validated assessment submitted for certification, and HITRUST performs central quality assurance before issuing the report. The fieldwork window for a validated assessment is at most 90 days. The step is done when the assessor has submitted the assessment and HITRUST has issued the certification or report, which you can verify against the assessed evidence library.
Reuse evidence in the ISO audit
Give the ISO certification body access to the same evidence library, with the ISMS records and the HITRUST mapping, so it can sample evidence without a second collection cycle. Keep a log of which evidence was reused and which was produced for one framework only. The ISO certification body makes its own judgment and may still sample records that the HITRUST assessor reviewed, so the library must hold the original artifacts rather than summaries. The output is a reuse log that the auditor can read alongside the library.
Schedule the ISO certification audit
Once the ISMS is operating and the evidence library is current, contact an accredited ISMS certification body and schedule the certification audit. Accredited bodies work to ISO/IEC 17021-1:2015 with ISO/IEC 27006-1:2024, which IAF MD 29:2024 required them to apply to all clients by 31 March 2026, so confirm the body's accreditation and its transition status before signing. A management system certification cycle runs three years, with at least one audit in every calendar year, so plan the surveillance audits from the start. The step is complete when the certification body has issued the certificate and the surveillance calendar is recorded in the compliance plan.
What drives HITRUST and ISO 27001 cost, and what to ask for in a quote
Neither HITRUST nor ISO 27001 has a public price you can budget from, so the first decision is to treat the quote as the only reliable number. HITRUST does not list prices on its public assessment pages and directs buyers to request information or contact sales. Assessments are created, scoped and submitted in MyCSF, which the Assessed Entity accesses through a subscription, so ask whether that subscription fee is separate from the external assessor's fee and whether it renews. For ISO, the standard itself is a small purchase: ISO prices the English PDF and ePub version of ISO/IEC 27001:2022 at CHF 155, and the climate amendment at CHF 0. The large cost is the certification audit, which an accredited certification body charges, not ISO. Ask each body for its written fee schedule and confirm whether it is accredited for your scope.
Cost moves with scope and readiness more than with the framework label. The main drivers are the number of sites and business units in scope, the number of systems that hold regulated data, how mature your existing controls are, and how much evidence already exists in a form an assessor can test. A HITRUST e1 or i1 assessment is scored against a fixed set of requirement statements, and a team with mature controls will spend far less time remediating gaps than one starting from policies. On the ISO side, the auditor's day count depends on sites, processes and the size of the Annex A control set your statement of applicability covers. Recurring costs differ too: an ISO certificate needs at least one audit every calendar year within a three-year cycle, while e1 and i1 certifications are valid for one year and r2 for two. Price the second and third years, not just the first.
What buyers ask before choosing or combining HITRUST and ISO 27001
Does a HITRUST certificate satisfy a customer's ISO 27001 request?
Usually not on its own. A HITRUST certificate is a HITRUST result, and ISO 27001 is a management system certificate issued by an accredited certification body, so the two proofs answer different questions. The HITRUST CSF's core structure is based on ISO/IEC 27001 and 27002, which means overlap is real, but overlap is not equivalence. Ask the customer which proof they need: a certificate for a named standard, a mapping of controls, or evidence of an information security management system. If they need ISO certification, plan a separate accredited audit. Ask whether a HITRUST mapping to ISO/IEC 27001:2022 is acceptable for their procurement file.
How long does each certification last?
The validity periods differ. HITRUST e1 and i1 certifications are valid for one year, and r2 certifications are valid for two years with an interim assessment due in the 90 days before the first anniversary (HITRUST Assessment Handbook v1.1). Under ISO/IEC 17021-1, an ISO 27001 certification cycle lasts three years, with at least one audit in every calendar year, either surveillance or recertification (European Accreditation FAQ 37.12). Plan the budget around both calendars if you hold both. Confirm with your assessor and certification body which dates and scope statements apply to your organization.
What does the internal team need to supply for each route?
Both routes need named owners for policies, asset inventories, risk treatment, access reviews and evidence. A HITRUST assessment is scored against control specifications in MyCSF, so the team must map its existing controls to those specifications and keep evidence current for the assessment period. An ISO 27001 audit tests the management system: scope, risk assessment, statement of applicability, internal audit and management review. The team should expect to answer auditor questions about how these processes run day to day. Confirm with the assessor which evidence formats they accept before preparation starts.
Can our team run a HITRUST or ISO 27001 readiness effort without outside help?
The team can prepare internally, but the validated result must come from an authorized party. Only Authorized HITRUST External Assessor organizations may perform validated assessments submitted for certification, and HITRUST performs central quality assurance before issuing reports (HITRUST Find an External Assessor page). For ISO 27001, the certificate comes from an accredited certification body, and ISO does not certify organizations itself (ISO certification page). Internal staff can do gap analysis, evidence collection and documentation. DeployOpen plans, implements, documents and prepares systems and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications.
What drives the cost and effort of each path?
Cost has several components: the assessor or certification body fee, HITRUST subscription access to MyCSF, internal staff time, remediation of control gaps, and tooling for evidence. HITRUST does not list prices on its public assessment pages and directs buyers to request information, so compare quotes on the same written scope. The main drivers are the number of in-scope systems, the number of locations, the current maturity of controls, the assessment level (e1, i1 or r2), and whether you pursue both frameworks. Ask each provider to itemize one-time work from recurring work such as surveillance audits, annual assessments and interim reviews.
How long does the process take given fieldwork and quality assurance service levels?
The timeline depends on preparation and on the assessor's schedule. For HITRUST, the validated assessment fieldwork window is at most 90 days for e1, i1 and r2 (HITRUST Assessment Handbook v1.1, chapter 4). HITRUST commits to a quality assurance service level of 30 days for e1 and 45 days for i1 validated assessments (HITRUST 2025 Trust Report). ISO 27001 timing depends on the certification body's stage 1 and stage 2 scheduling, which the body sets. Preparation before fieldwork is often the longest phase, and it varies with control maturity and scope. Ask the assessor for a written schedule that separates preparation, fieldwork and quality assurance.
Should we hold both HITRUST and ISO 27001, and in what order?
Hold both when customers in one market ask for a certifiable proof and customers in another ask for ISO certification. Many organizations start with the proof that their largest or most regulated customers require, then extend scope. Because the HITRUST CSF is built on ISO/IEC 27001 and 27002, shared controls can be evidenced once, but each program keeps its own scope, cycle and auditor. Ask customers for the exact request wording, the scope they need and the date they need it. Confirm with both assessors whether they accept shared evidence and how they handle changes made to the ISO 27001:2022 control set.
How DeployOpen prepares you for HITRUST, ISO 27001 or both
DeployOpen helps you plan and prepare the systems, controls and evidence that a HITRUST or ISO 27001 assessment will examine, in your own cloud accounts, data centers or air-gapped networks. We do not issue audit reports or certificates; authorized HITRUST external assessors and accredited ISO certification bodies do that work.
How we scope
- We agree scope in writing before work starts, including which HITRUST e1, i1 or r2 assessment, or which ISO/IEC 27001:2022 scope, you are targeting.
- The written scope names the systems, sites, business units and third parties that the assessment boundary will cover.
- Engagements are fixed-scope, with deliverables and timelines agreed up front; a quote follows from that written scope.
How we build
- We implement and harden the self-hosted platforms and controls inside your environment, mapped to the control requirements your chosen route will test.
- We document control ownership and evidence sources so each requirement can be traced to an artifact an assessor can review.
- Where HITRUST and ISO 27001 overlap, we map shared controls once so the same evidence can serve both assessments where your scope allows.
How we hand over
- You receive written documentation of configured controls, evidence locations, roles and the procedures your team runs after handover.
- We walk your internal owners through the evidence set so they can answer assessor questions without relying on us.
- We agree in advance what remains your responsibility, including management review, internal audit and the choice of assessor or certification body.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, useful for keeping evidence current between assessment cycles.
- Ask us to confirm which HITRUST CSF version, or which ISO/IEC 27001 and 27002 edition, your evidence set is built against before the assessment window opens.
- Re-validation cycles differ, so agree in writing who prepares evidence for each interim or surveillance review and when that work is scheduled.
