HITRUST does not publish a single price for certification. Your cost is the sum of three things HITRUST names in its own pricing guide: a MyCSF platform subscription, the assessment report fee paid to HITRUST, and the fees of the authorized External Assessor you hire. Add internal staff time and any remediation, and published industry estimates for total first-year cost run roughly $20,000 to $70,000 for an e1, $60,000 to $200,000 for an i1, and $150,000 to $1 million or more for an r2 (Thoropass).
Treat those ranges as planning estimates, not quotes. Scope, readiness and inheritance move the number more than anything else.
What are the cost components?
| Cost component | What it covers | Who you pay | Typical range (estimate) |
|---|---|---|---|
| MyCSF subscription | HITRUST’s platform for scoping, evidence and submitting the assessment | HITRUST | Several thousand dollars for short-term access; roughly $9,000 to $32,000+ a year for annual tiers |
| Assessment report | HITRUST’s QA review and the report or certification | HITRUST | Roughly $6,000 (e1) to $9,000 (r2); HITRUST says a readiness report starts at $3,625 |
| External Assessor | Testing your controls and submitting the validated assessment | An authorized assessor | Low tens of thousands for small e1 work to $100,000+ for large r2 projects |
| Readiness and remediation | Gap assessment and fixing what it finds | Consultants, your team | Often 10% to 40%+ of first-year cost |
| Internal staff time | Evidence collection, policies, coordination | Your team | Often hundreds of hours |
Ranges other than HITRUST’s own readiness report price come from Thoropass, an industry source. HITRUST does not set External Assessor fees; each assessor prices its own work based on the assessment type, systems in scope, timeline and remediation needs (HITRUST).
How does cost change from e1 to i1 to r2?
The three assessments are steps on the same ladder, and cost rises with the number of requirements tested (HITRUST):
| Assessment | Scope | Valid for | Total first-year cost (estimate) |
|---|---|---|---|
| e1 | Foundational requirements (44 in CSF v11.9; 43 in v11.7) | 1 year | About $20,000 to $70,000 |
| i1 | 182 requirements focused on leading practices | 1 year | About $60,000 to $200,000 |
| r2 | Tailored to your risk profile and regulations; the largest | 2 years (with an interim assessment) | About $150,000 to $1 million+ |
The r2’s two-year validity offsets some of its higher cost, but it still requires an interim assessment in the middle of the cycle. If you are still deciding which one you need, start with HITRUST e1 vs. i1 vs. r2.
What drives the price up or down?
- The assessment you choose. The single biggest lever. Many customers name the level they require, so check your contracts before buying more assurance than you need.
- Scope. Every system, location and data flow in scope adds testing and evidence. A tight scope is cheaper.
- Inheritance. Building on a HITRUST-certified cloud provider lets you inherit controls instead of testing them yourself.
- Readiness. Gaps found during the validated assessment cost more to fix than gaps found during readiness.
- Ongoing cost. e1 and i1 renew every year, and the r2 needs an interim assessment, so budget for recurring platform, report and assessor fees, not just year one.
How to get an accurate number
- Confirm which assessment your customers require.
- Define your scope (systems, locations, data) before asking for quotes.
- Ask two or three authorized External Assessors for quotes, and ask what is included: readiness, the validated assessment, remediation support, and the interim assessment for an r2.
- Budget HITRUST’s fees separately from assessor fees, and price your internal staff time.
Which External Assessors can you ask for a quote?
All validated HITRUST assessments are performed by an authorized External Assessor. Three examples from HITRUST’s External Assessor list, listed alphabetically (not a ranking or endorsement):
| Assessor | Headquarters | Profile |
|---|---|---|
| 360 Advanced | St. Petersburg, FL | View profile |
| Coalfire | Westminster, CO | View profile |
| Frazier & Deeter | Atlanta, GA | View profile |
Listings were verified against HITRUST’s directory on August 19, 2026. Ask each firm which assessments it performs and confirm current authorization with HITRUST before engaging.
Compare authorized HITRUST External Assessors in our assessor directory, or get matched with assessors that fit your assessment type, scope and budget.
Frequently asked questions
How much does HITRUST certification cost?
There is no single price. Published industry estimates put total first-year cost at roughly $20,000 to $70,000 for an e1, $60,000 to $200,000 for an i1, and $150,000 to $1 million or more for an r2. Scope, readiness and how many controls you can inherit drive where you land.
What fees does HITRUST itself charge?
HITRUST charges for access to its MyCSF platform and for the assessment report (often called a report credit). HITRUST's own pricing guide says a readiness assessment report starts at $3,625. External assessor fees are separate and set by each assessor, not by HITRUST.
Why is the r2 so much more expensive than the e1?
The e1 covers a small set of foundational requirements (44 in CSF v11.9; 43 in v11.7), while the r2 is tailored to your risk profile and the regulations you must meet, so it usually covers far more requirements and scores each across several maturity levels. More requirements mean more assessor testing, more evidence and more remediation.
Is the HITRUST CSF free?
HITRUST says the CSF framework is available at no cost to eligible organizations, so you can review the requirements before committing. Certification is what costs money: the platform, the report and the assessor.
How can I lower the cost of HITRUST certification?
Choose the assessment your customers actually require, keep the scope tight, inherit controls from a HITRUST-certified cloud provider where possible, and fix gaps before the validated assessment starts. Getting quotes from more than one authorized External Assessor also helps.