HITRUST or NIST 800-171 first when you hold CUI and PHI
If you hold both controlled unclassified information and protected health information, the first question is which buyer's acceptance gates the contract you need most. Where a contract or agreement requires NIST SP 800-171, start there, because the contracting agency decides whether your implementation meets the requirement. For DoD work, that judgment runs through CMMC under 32 CFR Part 170, where Level 2 certification assessments are performed by C3PAOs and the Level 2 requirements are identical to Rev. 2. Confirm with the contracting officer which revision your contract cites before you scope anything, because DoD guidance on Rev. 2 and Rev. 3 has changed during 2026.
HITRUST usually makes sense first when healthcare customers drive the demand and your revenue is concentrated there. A HITRUST e1, i1 or r2 certification is issued after validated assessment by an Authorized HITRUST External Assessor, with HITRUST performing quality assurance before reports issue. Ask each healthcare buyer whether it accepts an e1 or i1 for its vendor reviews, and whether it expects r2. Those answers, not general preference, should set the order.
A HITRUST Insights Report or a targeted assessment is not a substitute for agency acceptance. The NIST SP 800-171 Insights Report and the targeted assessment map requirements to 800-171, but neither is the agency's judgment of your compliance, and the targeted assessment is not certifiable. Use them as evidence to share with a contracting officer when the agency accepts them, and confirm that acceptance in writing before relying on them. Plan the evidence set once, so that the same control records can support the HITRUST assessment and the agency's review.
How HITRUST and NIST 800-171 differ on scope, proof and authority
This table sets the HITRUST CSF products against NIST SP 800-171 Rev. 3 and the Rev. 2 baseline used by CMMC Level 2, row by row on who requires them, what they produce and who decides compliance. Read it as a question of which authority your contract or regulator recognizes, because a HITRUST report and an 800-171 assessment answer different questions.
| Dimension | HITRUST CSF (e1, i1, r2, Insights, targeted) | NIST SP 800-171 (Rev. 3 and Rev. 2 for CMMC Level 2) |
|---|---|---|
| Who requires it | Not required by law. Chosen by the organization or requested by customers, payers or partners. Insights Reports and targeted assessments are selected by the entity. | Required by federal agencies through contracts or agreements for CUI on nonfederal systems. 32 CFR 2002.14(h)(2) directs agencies to use it. |
| Structure and requirement count | CSF has 14 control categories, 49 control objectives and 156 control specifications. e1 has 44 and i1 has 182 requirement statements in v11.9. | Rev. 3 has 97 requirements in 17 families. Rev. 2 has 110 requirements in 14 families, which CMMC Level 2 uses. |
| Proof produced | e1, i1 and r2 assessments produce a HITRUST certification. Insights Reports and targeted assessments produce a report, and the targeted assessment is not certifiable. | The assessment is judged against determination statements in SP 800-171A Rev. 3. CMMC Level 2 produces a certification assessment result under 32 CFR Part 170. |
| Who issues or decides it | Authorized HITRUST External Assessor organizations perform validated assessments, and HITRUST performs central quality assurance before issuing reports. | The contracting federal agency decides compliance for SP 800-171. For DoD, Level 2 certification assessments are performed by C3PAOs and Level 3 by DCMA DIBCAC. |
| Validity | e1 and i1 certifications are valid for one year. r2 certifications are valid for two years with an interim assessment due in the 90 days before the first anniversary. | No validity period is set by NIST. Validity and reassessment for CMMC are set by the DoD program. Confirm the current terms with the contracting officer. |
| Version status | CSF v11.9.0 is the current version, available in MyCSF from September 24, 2026. | Rev. 3 and SP 800-171A Rev. 3 are current NIST versions as of October 2026. Rev. 2 was withdrawn 14 May 2024 but remains the CMMC Level 2 baseline. |
| Is it a certification? | Yes for e1, i1 and r2. No for Insights Reports and targeted assessments. | No. NIST does not certify. Certification exists only under the CMMC program for DoD contracts. |
What a HITRUST report can show for NIST 800-171
A HITRUST NIST SP 800-171 Insights Report and a targeted assessment can show how your controls line up with the 800-171 requirements, but neither one is an 800-171 determination. HITRUST offers the NIST SP 800-171 Insights Report among its ten Insights Reports, and its targeted assessment is a non-certifiable self-assessment built from requirement statements mapped to authoritative sources the entity selects, such as NIST SP 800-171. The mapping is HITRUST's harmonization work. NIST does not check the correctness of non-NIST mappings and does not endorse them, so the mapping is a useful starting point that you still need to verify against the requirement text and your own evidence.
Reconcile the scope before you rely on any HITRUST output. Confirm which revision the contract names. Rev. 3 contains 97 requirements in 17 families, while the Rev. 2 baseline has 110 requirements in 14 families, and DoD contractors are assessed against Rev. 2 through CMMC Level 2. Rev. 3 also uses organization-defined parameters (ODPs). NIST does not assign ODP values, and if the federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. Ask the contracting officer or the agency to confirm the ODP values, then record them in your System Security Plan and in the mapping so that a HITRUST line item cannot be read as satisfying a requirement whose parameters were never set.
Treat the HITRUST output as evidence for the assessor, not as the assessment itself. Ask who will judge the requirement-level result for your contract, whether that is the agency, a CMMC C3PAO for Level 2, or DCMA DIBCAC for Level 3, and what each will accept. A HITRUST report does not replace a CMMC certification or an agency's review of your SSP, POA&M and affirmations. Before purchasing, ask the HITRUST External Assessor which 800-171 revision and ODP values the mapping uses and how each mapped requirement is evidenced.
What a HITRUST report cannot replace
A HITRUST certificate or Insights Report can support an 800-171 story, but it does not decide whether a federal customer accepts your CUI controls. The cards below cover the bodies and rules that make that decision, and the version and parameter questions you need to settle before you rely on any HITRUST output.
Agency acceptance under federal responsibility
NIST states that application of SP 800-171, and any compliance issues, are the responsibility of the federal agency holding the contract with the nonfederal organization, regardless of the organization's size. A HITRUST report therefore becomes evidence only if the contracting officer agrees to accept it. Ask the agency in writing whether it will accept a HITRUST Insights Report or targeted assessment, which requirements it expects to see, and what evidence format it wants for each.
CMMC Level 2 certification by a C3PAO
For DoD work involving CUI, CMMC Level 2 certification assessments are performed by C3PAOs authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. Under 32 CFR 170.14(c)(3), the Level 2 security requirements match NIST SP 800-171 Revision 2, counted as 110 requirements under 32 CFR 170.4. A HITRUST assessment, whatever its scope, does not substitute for this certification. Confirm with your contracting officer which CMMC level applies to your contract before planning evidence.
DIBCAC assessment for Level 3
Level 3 certification assessments are performed by DCMA DIBCAC rather than a C3PAO. Where a contract calls for Level 3, the government assessor examines your implementation directly, and HITRUST evidence can inform preparation but cannot satisfy the assessment. Ask the program office whether your contract requires Level 3, and plan the scope of your SP 800-171 controls against the Level 3 requirements in the final rule rather than against a HITRUST control set.
Rev. 2 or Rev. 3 version question
The version you must meet is not settled. NIST withdrew SP 800-171 Rev. 2 on 14 May 2024, but a DoW class deviation dated 3 September 2026 names Rev. 2 explicitly while CMMC Phase 2 is suspended. A FAR overhaul proposed rule published 23 June 2026 would require Rev. 3 with DoW-published ODP values, and was not final as of October 2026. Map your HITRUST scope to both revisions, and confirm the governing version in each contract.
Organization-defined parameter assignment
Rev. 3 introduced organization-defined parameters, and NIST does not assign their values. If a federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. A HITRUST control specification does not set these values for you, and a mapped control can pass review while an unassigned parameter leaves a requirement open. Record your ODP values in writing and ask the agency whether they match its expectations.
A HITRUST certificate is not an 800-171 result
A HITRUST e1, i1 or r2 certificate reports against the HITRUST CSF, not against the 800-171 requirement set, and an 800-171 mapping in an Insights Report or targeted assessment is not a certification. Targeted assessments are self-assessments and are not certifiable, while the certificate itself is valid for one year (e1, i1) or two years (r2). Keep your 800-171 statement of compliance separate from the HITRUST certificate, and do not present one as the other to a customer.
Who assesses each path and what it issues
This table shows who performs each assessment, what document or certificate it produces and how long it stays current. Read it by first asking whether your customer needs a certificate, a self-assessed mapping or a government-recognized certification, because the answer decides which row applies.
| Path | Who assesses | What it issues | Cycle |
|---|---|---|---|
| HITRUST e1 | Authorized HITRUST External Assessor, with HITRUST central quality assurance before issue | HITRUST e1 certification | Valid one year |
| HITRUST i1 | Authorized HITRUST External Assessor, with HITRUST central quality assurance before issue | HITRUST i1 certification | Valid one year |
| HITRUST r2 | Authorized HITRUST External Assessor, with HITRUST central quality assurance before issue | HITRUST r2 certification, which can carry NIST 800-171 requirements only as mapped in the CSF | Valid two years, with an interim assessment due in the 90 days before the first anniversary |
| HITRUST Insights Report (NIST SP 800-171) | Assessment performed under HITRUST's Insights Report process, confirm the assessor and report terms with HITRUST | Insights Report that summarizes the entity's posture against NIST SP 800-171 requirements | Confirm the refresh expectation with HITRUST and your customer |
| HITRUST targeted assessment (NIST SP 800-171) | The entity itself, a non-certifiable self-assessment of requirement statements mapped to NIST SP 800-171 | Self-assessment results, not a HITRUST certificate | Set by the entity and the agreement with the contracting party |
| NIST SP 800-171 self or agency assessment | The nonfederal organization, or the federal agency that holds the contract, using SP 800-171A Rev. 3 methods | Evidence and assessment results held by the organization or accepted by the agency, not a NIST certificate | Set by the contract and the agency, which NIST says is responsible for compliance issues |
| CMMC Level 2 | C3PAO authorized or accredited by The Cyber AB | CMMC Level 2 certification assessment outcome under 32 CFR Part 170 | Confirm current validity and phase status against 32 CFR Part 170 and DoD guidance |
| CMMC Level 3 | DCMA DIBCAC | CMMC Level 3 certification assessment outcome under 32 CFR Part 170 | Confirm current validity and phase status against 32 CFR Part 170 and DoD guidance |
Doing both: the order and the shared evidence
This sequence settles which 800-171 revision and parameter values govern the contract before any mapping starts, so one evidence set can serve the HITRUST assessment and any CMMC or agency review without rework. Each assessor still decides for itself what it will rely on.
Confirm the required 800-171 revision with the contracting officer
Ask the contracting officer which revision of NIST SP 800-171 the contract or task order requires, and whether the DFARS clause and any class deviation in effect name Revision 2 or Revision 3. Your contracts or compliance lead owns this request and should record the written answer. The step is done when the revision is named in writing and the contract file holds that answer. Because a proposed FAR overhaul would move contractors toward Revision 3, confirm whether the rule applies to your contract before you rely on either revision.
Obtain organization-defined parameter values in writing
If the required revision is Revision 3, ask the agency or DoW CIO for the organization-defined parameter values that apply to your contract. NIST does not assign these values, and if the agency does not specify them, the nonfederal organization must assign them to complete the requirement. Your compliance lead records each value with its source and date. The step is done when every parameter the contract needs has a documented value that you can show an assessor.
Scope CUI and PHI systems together
Map every system, enclave, service and person that stores, processes or transmits CUI or protected health information, including shared identity, logging and backup services. Your security architect and system owners draw one boundary and note which systems fall under both regimes. The output is a single scope statement with a system inventory. Confirm with each assessor how it defines scope, because the boundary you draw for CUI may not match the one an external assessor will test for HITRUST.
Map controls once into a single evidence set
Build one control register that links each internal control to the SP 800-171 requirement it satisfies and to the HITRUST control specification it supports. Your GRC lead owns the register, and control owners attach the artifacts. The set is complete when each 800-171 requirement and each in-scope HITRUST requirement points to at least one owned, dated artifact. Use HITRUST's published mappings and NIST's documents as the reference, and verify any mapping you build yourself rather than assuming it.
Run the targeted or Insights route for healthcare buyers
If a healthcare customer needs evidence of 800-171 alignment but not a certificate, consider a HITRUST targeted assessment, which is a non-certifiable self-assessment built from the requirement statements you select. Alternatively, ask whether an Insights Report for NIST SP 800-171 meets the buyer's need. Your compliance lead decides which route fits and documents the reason. The step is done when the buyer has confirmed in writing which output it will accept, since a targeted assessment and an Insights Report do not replace an agency assessment.
Schedule the HITRUST validated assessment separately
Engage an Authorized HITRUST External Assessor for the e1, i1 or r2 validated assessment that your customers require. Your program manager books the assessor and sets the fieldwork window, which must fit within the assessor's validated fieldwork limit. The step is done when the assessor has confirmed scope and the evidence it will accept in writing. Do not assume that a HITRUST certificate or report will satisfy any CMMC or agency assessment.
Schedule any CMMC assessment on its own track
If the contract requires CMMC certification at Level 2 or Level 3, book the assessment with the body that the CMMC rules name for that level, which is a C3PAO for Level 2 and DCMA DIBCAC for Level 3. Your compliance lead owns the timetable and the assessor's evidence requirements. The step is done when the assessor's scope and evidence list are in your file. Expect a separate fieldwork window, separate scope confirmation and separate findings from the HITRUST assessment.
Confirm evidence reuse with each assessor
Share the common evidence set with each assessor and ask, in writing, which artifacts it will accept, how it will review them and whether it will rely on evidence produced for the other assessment. Your compliance lead keeps the written answers with the evidence register. The step is done when each assessor has accepted or rejected each reused artifact in writing. Reuse saves effort only where each assessor has reviewed the evidence for its own purpose.
Why the version your contract names decides the work
The revision named in your contract, not the newest NIST document, sets the control baseline you must meet. For DoD work, Revision 2 remains operative. Under 32 CFR 170.14(c)(3), the CMMC Level 2 security requirements are identical to NIST SP 800-171 Revision 2, and a DoW class deviation (2026-O0025, Revision 3, signed 3 September 2026) has contracting officers use a revised DFARS 252.204-7012 that names Revision 2 explicitly. That deviation cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. A HITRUST mapping built on Rev. 3 numbering will therefore not, by itself, answer a Rev. 2 requirement set of 110 items.
A pending change could move the target. A FAR overhaul proposed rule published 23 June 2026 would require contractors handling CUI to comply with SP 800-171 Revision 3 using organization-defined parameter values published by the DoW CIO. Comments closed 23 July 2026, and the rule was not final as of October 2026. Rev. 3 also changes the numbering to 03.01.01 through 03.17.03 and introduces ODPs that, if an agency does not specify them, the nonfederal organization must assign. Plan for a possible move to Rev. 3 without treating it as settled, and keep the mapping in a form that can be re-keyed to a new revision.
Confirm the revision in every solicitation, contract clause and modification before you scope a HITRUST assessment or an Insights Report. Ask the contracting officer which SP 800-171 revision and which ODP values apply, and ask whether the agency treats a HITRUST report as evidence at all. Record the answers in the contract file. If the clause names Revision 2 and your HITRUST scope uses Revision 3 mappings, you carry two sets of requirement IDs to reconcile during the assessment.
How much work, time and cost does each path take?
Does a HITRUST Insights Report replace an NIST 800-171 assessment?
No. A HITRUST Insights Report mapped to NIST SP 800-171 gives you a structured view of your posture against that standard, but it does not replace an assessment the contracting agency or the CMMC process requires. Under the DoD route, Level 2 certification assessments are performed by C3PAOs and Level 3 by DCMA DIBCAC, so a HITRUST report is supporting evidence at most. Ask your contracting officer which assessment they will accept before you scope any HITRUST work, and ask the assessor to show exactly which 800-171 requirements the report covers.
What drives the cost of a HITRUST e1, i1 or r2 assessment?
The main cost components are the external assessor's fees for fieldwork and quality review, your internal preparation effort, and any remediation your gaps require. Assessor fees are paid to an Authorized HITRUST External Assessor organization, and HITRUST's own fees for the validated assessment are a separate line item. The e1 baseline is the smallest, with 44 requirement statements in v11.9, the i1 has 182, and the r2 is larger again, so scope tracks the level you choose. Targeted assessments are self-assessments that you select against sources such as NIST SP 800-171, so they cost less in assessor time but produce no certificate. Request a quote that separates assessor fees, HITRUST fees, one-time setup and any recurring interim or renewal work.
What drives the effort of an NIST 800-171 or CMMC assessment?
Effort depends mainly on how many requirements you must evidence and how many of them your environment already meets. SP 800-171 Rev. 3 has 97 security requirements, while CMMC Level 2 uses the 110 Rev. 2 requirements under 32 CFR 170.14(c)(3), so the version your contract names changes the work. Rev. 3 also introduces organization-defined parameters, and if the agency does not set them you must assign values yourself, which adds decision work before evidence collection starts. Other drivers include the size of your CUI enclave, how many systems and third parties touch CUI, and how well documented your current controls are. Confirm the applicable version in your contract or the current DFARS clause before estimating effort.
How long can a HITRUST validated assessment fieldwork window run?
The assessor's validated assessment fieldwork window is at most 90 days for e1, i1 and r2 assessments, according to the HITRUST Assessment Handbook v1.1. That limit covers the assessor's fieldwork, not your preparation or remediation, which can take considerably longer and depends on your starting position. Your internal readiness work, evidence collection and any gap closure happen before that window opens. Once the report is submitted, HITRUST performs central quality assurance before issuing it, so build that review step into your plan. Confirm the current window and submission steps with your assessor before you set a target date.
Can our team complete a HITRUST or 800-171 self-assessment alone?
Your team can prepare and run a self-assessment, but a HITRUST e1, i1 or r2 certification requires an Authorized HITRUST External Assessor, so self-work alone cannot produce that certificate. A targeted assessment is a self-assessment by design, which makes it a feasible internal exercise if you have staff who know the requirements and your systems. For 800-171, the agency or CMMC assessor judges compliance, so an internal assessment can show readiness but not satisfy the contract. Teams often lack capacity for the examine, interview and test steps that SP 800-171A Rev. 3 describes, so check that your people can produce that evidence before committing. If you bring in DeployOpen, the engagement is fixed-scope with deliverables agreed in writing before work starts.
What should we ask a consultant or assessor for in a written quote?
Ask for a written quote that names the framework, version and level, the exact requirement set in scope and the systems or sites covered. Require separate line items for assessor or certification fees, consultant preparation work, remediation support and any retainers for ongoing evidence upkeep. Confirm who pays the external assessor and who pays HITRUST, and whether any interim assessment or recertification is included. Ask how the quote handles changes in scope, including a move from Rev. 2 to Rev. 3 requirements if your contract changes. Also ask for the assumed evidence volume, the assessor's authorization status and the deliverables you will receive. DeployOpen does not publish a price list, so expect a quote that follows from the written scope.
How DeployOpen scopes readiness for both frameworks
The sequence below turns a shared control set into a written scope, one evidence map and a set of readiness outputs that independent assessors can test, all inside your own infrastructure.
Confirm which NIST 800-171 version governs
Start by asking the contracting agency or prime contractor which SP 800-171 revision and which DFARS or CMMC language apply to your contracts, since the requirement set and the organization-defined parameter values depend on it. DeployOpen records the answer in writing, including any open rulemaking that could change it, and does not assume a version. The step is complete when the governing revision and its source are named in the scope document.
Define the HITRUST assessment scope and type
Decide with you whether the work targets an e1, i1 or r2 assessment, a targeted assessment mapped to NIST SP 800-171, or an Insights Report, because each produces a different kind of output. DeployOpen documents the systems, facilities and data flows in scope, including the CUI environment and any inherited cloud controls. The step closes with a written scope listing the assessment type, the boundary and the deliverables.
Map shared controls across both requirement sets
Build a cross-reference that links each NIST 800-171 requirement to the HITRUST control specifications that address it, and flags requirements that HITRUST does not cover on its own. DeployOpen reviews each mapping against the authoritative source text rather than relying on a summary, and records gaps as explicit items. The output is a traceability matrix that your team and the assessor can both read.
Assess current controls against the gap list
Run a readiness review of the in-scope systems against the mapped requirements, testing whether each control exists, is designed correctly and is operating. DeployOpen notes where organization-defined parameter values must be set, because NIST's Rev. 3 requirements leave them to the organization when the agency does not specify them. The step closes with a gap register ranked by remediation effort and by the requirement it affects.
Implement and harden the remediation items
Carry out the agreed fixes inside your cloud accounts, data centers or air-gapped networks, such as configuration changes, logging, access reviews and documented procedures. Your staff keep administrative ownership, and DeployOpen works under the change control you already run. Each item closes when the fix is deployed and a reviewer confirms it against the requirement it addresses.
Test the controls and collect evidence
Where the written scope includes it, run security testing of applications, infrastructure or APIs to check that the controls hold under attack, and feed the results back into the gap register. DeployOpen then assembles the evidence package, mapping each artifact to the requirement it supports, such as configuration exports, logs and interview notes. The step is done when every in-scope requirement points to dated evidence.
Hand over documentation and readiness outputs
Deliver the system security plan, policies, the traceability matrix, the evidence index and the remaining gap list in a form your assessor can use. DeployOpen clarifies that these are readiness materials and that it does not issue audit reports, attestations or certifications. An independent HITRUST External Assessor or the relevant federal assessment body performs the validated assessment, and your team decides when to commission it.
Agree ongoing support in a separate scope
After handover, decide whether you need continued support, upgrades or recurring testing, which DeployOpen offers as retainers under their own written scope. Recurring costs depend on the number of systems, the frequency of change and the revision updates that arrive, so confirm these in the quote. A quote for any of these steps follows from the written scope, and no work starts until both sides sign it.
