Home / Services / HITRUST Certification

HITRUST® Authorized External Assessor

HITRUST Certification, One Summit at a Time.

Validated e1, i1, and r2 assessments from a HITRUST external assessor organization that makes a complex process clear.

Request a Consultation Compare e1, i1 & r2
HITRUST Authorized External Assessor

The basics

HITRUST at a glance

What a HITRUST assessment is, and what affects its cost.

What is a HITRUST assessment?

A HITRUST assessment tests an organization's security and privacy controls against the HITRUST CSF, a certifiable framework mapped to more than 60 authoritative sources, including HIPAA, ISO/IEC 27001, NIST, PCI DSS, and CMMC. Originally developed in 2007 to help secure sensitive healthcare data, HITRUST has evolved into a standard for information protection across finance, technology, and regulated industries worldwide. An authorized External Assessor such as Linford & Company tests your controls, and HITRUST reviews the results before it issues a certification.

What affects the cost of a HITRUST assessment?

The assessor's fee depends mainly on the assessment type (e1, i1, or r2), the number of systems, locations, and requirements in scope, and how complex your environment is. HITRUST also charges its own fees, including a MyCSF subscription and certification fees, which are separate from the assessor's fee. We give you a specific quote before the engagement begins.

Assessment types

Choose Your Assessment

Three validated assessments with different levels of assurance. Many organizations choose one and renew it each year. We'll help you pick the right fit.

  1. e1 · Essentials

    • 1-year validated assessment and certification
    • Entry-level security controls and basic cyber hygiene
    • A focused assessment for organizations that need essential assurance

  2. i1 · Implemented

    • 1-year validated assessment and certification
    • More comprehensive assurance than the e1, with more controls
    • Focused on whether controls are implemented

  3. r2 · Risk-based

    • 2-year validated assessment and certification
    • Controls tailored to your identified risk factors
    • Maturity-based approach for the highest assurance

The HITRUST CSF

One Assessment, Many Frameworks

The HITRUST CSF® brings the requirements of many standards and regulations together in one certifiable framework, so a single assessment can address several of them.

  • Mapped to 60+ authoritative sourcesIncluding HIPAA, ISO/IEC 27001:2022, NIST, PCI DSS, and CMMC.
  • A formal certificationHITRUST reviews every assessment before it certifies, which sets it apart from other frameworks.
HIPAAISO 27001NISTPCI DSSCMMC60+ more HITRUSTCSF®

How it works

The Path to Certification

A proven route, guided by assessors who have done it many times.

  1. Readiness

    An optional readiness assessment in MyCSF shows where controls may not yet meet requirements before the validated assessment begins.

  2. Validated assessment

    Our assessors test your controls against the HITRUST requirements in scope, and we set the fieldwork schedule with you at kickoff.

  3. HITRUST QA & certification

    We submit findings to HITRUST through MyCSF and help answer HITRUST's questions.

  4. Interim & renewal

    e1 and i1 renew each year. An r2 lasts two years, with an interim assessment in between.

Artificial intelligence

HITRUST for AI

New HITRUST assessments for organizations building or adopting AI.

AI Risk Management Assessment

51 practical AI risk controls aligned with ISO 23894 and the NIST AI RMF, in one streamlined set you can measure and report against.

AI Security Assessment & Certification

Clear, practical security controls that help AI platform and service providers adopt and secure AI technologies with confidence.

Is it a fit?

Is HITRUST Right for You?

HITRUST may be the right fit if:

  • You create, access, store, or share sensitive data, such as protected health information
  • Customers or partners, especially in healthcare, ask for HITRUST certification
  • Your security program is mature and you can dedicate time to the assessment
  • You want one assessment that maps to HIPAA, ISO 27001, NIST, PCI DSS, and more

Not there yet? Many organizations start with a SOC 2 audit first.

Request a HITRUST Consultation

Tell us about your organization and a partner will be in touch.

We use your details only to talk with you about your HITRUST assessment. See our Privacy Policy.

Our partners

Your HITRUST Assessors

Vetted by HITRUST, with annual training and credentials including CCSFP, CHQP, CISA, CISSP, and GSNA. Meet all 20 partners

  • Richard Rieben

    Partner

    CISSP, CCSFP, CHQP, GSNA, QSA, CySA+, SecurityX, CMMC Certified Assessor (CCA), CCP

    HITRUST practice lead with over 20 years in IT and cybersecurity, leading HITRUST, SOC, CMMC, PCI DSS, and NIST assessments.

  • Rob Pierce

    Partner

    CISSP, CISA, CCSFP, CHQP

    Helps lead the HITRUST practice and has completed over 800 SOC examinations. Began his career as an IT auditor at PwC.

  • Jenny Shen

    Partner

    CISA, CISSP, CCSFP, QSA, ISO 27001 Senior Lead Auditor, ISO 27701 Lead Auditor

    Serves SaaS companies across SOC, HIPAA, ISO 27001, HITRUST, and PCI DSS, after seven years at Ernst & Young.

  • Isaac Clarke

    Partner

    CPA, CISA, CISSP, CCSFP, ISO 27001 Lead Auditor

    Specializes in SOC, HIPAA, HITRUST, and ISO assessments for companies from startups to the Fortune 100. Began his career at Ernst & Young.

Frequently asked questions

HITRUST Questions

Quick answers about HITRUST assessments with Linford & Company.

How much time will our team need to dedicate?

A HITRUST assessment requires extensive involvement from your organization, roughly 80 to 750 hours depending on scope and assessment type. Reaching r2 certification can take a year or more, while an e1 or i1 is usually much shorter.

What do we receive at the end?

We submit our testing results to HITRUST through MyCSF for its quality review. HITRUST then issues a validated assessment report and, when the certification criteria are met, a certification letter valid for one year (e1 or i1) or two years (r2).

Are there costs beyond the assessor's fee?

Yes. Organizations that pursue certification also pay HITRUST directly for certification and for a MyCSF subscription. We give you a specific quote for our work before the engagement begins.

Should we start with SOC 2 instead?

Often, yes. Because HITRUST is complex and time-intensive, it's generally pursued by mature organizations. Many organizations start with a SOC 2 audit before considering HITRUST.

From the blog

Learn more from our auditors

Visit the blog →

Let's get started

Talk to a partner, not a sales team.

Talk with a partner about which HITRUST assessment fits your organization.

Request a Consultation