Choose a firm that is on HITRUST’s current list of authorized External Assessors, performs the assessment you need (e1, i1 or r2), and can tell you exactly who will staff your engagement, how it will scope the work, when it can start and what its fee covers. HITRUST vets every External Assessor, but it is explicit that it “does not recommend specific EA Organizations for engagements” and that the organization being assessed is responsible for its own due diligence (HITRUST).
That due diligence is what this guide is for. The questions below are drawn from the rules HITRUST sets for assessors in its Assessment Handbook, so a good firm should be able to answer every one of them.
What is the difference between an External Assessor and a Readiness Licensee?
HITRUST’s directory lists two kinds of firm, and only one of them can take you all the way to certification.
| External Assessor | Readiness Licensee | |
|---|---|---|
| Readiness and gap assessments | Yes | Yes |
| Validated assessment submitted to HITRUST for certification | Yes | No |
| Minimum HITRUST-certified staff | At least 5 CCSFPs and 2 CHQPs at all times | At least 2 CCSFPs at all times |
| Approval | Approved by HITRUST through an application and vetting process | Licensed by HITRUST for readiness work |
Sources: HITRUST directory and Assessment Handbook (sections 3.2.3 and 3.2.9). CCSFP (Certified CSF Practitioner) and CHQP (Certified HITRUST Quality Professional) are HITRUST’s individual credentials.
If you only want help preparing, either type works. If you want a certification, you need an External Assessor for the validated assessment.
What does HITRUST check, and what is left to you?
HITRUST’s vetting covers each firm’s policies and procedures and the backgrounds of the people who perform assessments. HITRUST also says firms that are not on its list “are not authorized to conduct HITRUST readiness or assessment work” (HITRUST).
What HITRUST does not do is judge fit. It “cannot guarantee that any EA Organization will be successful” on a given engagement. Experience with organizations like yours, responsiveness, price and scheduling are yours to evaluate.
What questions should you ask a HITRUST assessor?
| Question | Why it matters |
|---|---|
| Are you currently listed as a HITRUST External Assessor? | Confirm it on HITRUST’s list yourself. Readiness Licensees cannot perform the validated assessment. |
| Which assessments do you perform (e1, i1, r2), and how many have you completed for organizations like ours? | Experience with your assessment type, industry and environment shortens the learning curve. |
| Who are the engagement executive, engagement lead and QA reviewer? | HITRUST requires all three to be reported on a validated assessment. The executive and lead must be CCSFPs; the QA reviewer must hold both CCSFP and CHQP and cannot perform any other role on your assessment. |
| How much of the work will CCSFPs do? | HITRUST requires at least 50% of validated assessment hours to be performed by CCSFPs. |
| How will you scope our assessment? | Scope drives effort, cost and timeline more than almost anything else. |
| Can you rely on our existing reports or inherited controls? | Reliance on third-party audits (for example, a SOC 2 Type II) is at the assessor’s discretion and requires the assessor to map the report to HITRUST requirements. |
| When can you start fieldwork, and how do you plan around the 90-day window? | All validated testing must happen within a 90-day fieldwork period. |
| What exactly does your fee include? | Ask whether readiness, the validated assessment, corrective action plan (CAP) support and, for an r2, the interim assessment are included or priced separately. |
| How do you support us during HITRUST’s QA review? | HITRUST reviews submitted assessments before issuing a report, and questions can come back to you and your assessor. |
Staffing and testing requirements are from the Assessment Handbook, sections 3.2.3 to 3.2.12, 11.2.5 and 12.3.
Can the same firm do your readiness assessment and your certification?
Usually, yes, within limits. HITRUST’s independence rules allow an External Assessor’s people to perform readiness or gap assessments, policy and procedure consulting assessments, penetration testing and vulnerability scanning for the organization they assess, as long as that work excludes remediation such as writing your policies or implementing and operating your controls (Assessment Handbook, section 3.3).
The firm must also be a separate legal entity from you, and your management cannot restrict the nature, scope or extent of testing the assessor decides is required. If anyone at the firm helped implement or operate the controls under review in the prior 12 months, they cannot work on the validated assessment, and a separate team with a separate engagement executive must be brought in.
Ask any firm that offers both consulting and assessment how it keeps those teams separate.
What are the red flags?
- The firm is not on HITRUST’s list, or is listed only as a Readiness Licensee but offers to “certify” you.
- A guaranteed outcome. The assessor tests and submits; HITRUST performs its own quality review of a validated assessment before a report or certification is issued.
- Offering to write your policies and then assess them. Writing policies is remediation work that HITRUST’s independence rules carve out.
- Testing controls you just put in place. HITRUST requires new or remediated controls to be operating for at least 90 days before they can be tested as implemented, and policies and procedures for at least 60 days (Assessment Handbook, sections 11.2.8 and 11.2.10). A firm that skips this conversation may be setting you up for low scores.
- A quote with no scope. A number given before anyone has asked about your systems, locations and data is not a real number.
How should you compare quotes?
Put proposals side by side on the same scope and ask each firm to break out:
- Readiness or gap assessment, if you want one
- The validated assessment itself (e1, i1 or r2)
- Remediation support and CAP review
- The r2 interim assessment, if applicable
- Travel and any on-site work
- What happens, and what it costs, if HITRUST’s QA review raises questions
Remember that HITRUST’s own fees for the MyCSF platform and the assessment report are separate from what the assessor charges. Our guide to HITRUST certification cost breaks down each component.
How do you build a shortlist?
- Settle the assessment type first. Your customers’ requirements usually decide it; see HITRUST e1 vs. i1 vs. r2. Firms often describe their services by assessment type; for example, ecfirst, one of the firms listed in our directory, has separate pages on its website for the e1, i1 and r2.
- Write down your scope: systems, locations, cloud providers and data types.
- Pick two or three External Assessors from HITRUST’s list. HITRUST’s own directory lets you select up to five firms, and its product specialists will connect you with them (HITRUST).
- Send every firm the same scope and the questions above, then compare the answers, the named team and the itemized fee.
- Confirm authorization with HITRUST before you sign.
You can compare all firms HITRUST lists as External Assessors or Readiness Licensees in our assessor directory, or get matched with assessors that fit your assessment type, scope and timeline. This site is independent and not affiliated with HITRUST, and listing a firm is not an endorsement.
Frequently asked questions
How do I know if a HITRUST assessor is authorized?
Check HITRUST's Find an External Assessor page. HITRUST says organizations that are not on its list are not authorized to conduct HITRUST readiness or assessment work, and only External Assessors can perform the validated assessments that are submitted to HITRUST for certification.
What is the difference between a HITRUST External Assessor and a Readiness Licensee?
External Assessors are approved and trained by HITRUST to conduct validated assessments, which are what lead to certification. Readiness Licensees are licensed to use the HITRUST framework for readiness and advisory work, but they cannot perform the validated assessment itself.
Does HITRUST recommend specific assessor firms?
No. HITRUST vets each External Assessor, but it says it cannot guarantee that any firm will be successful on a given engagement, does not recommend specific firms, and expects the organization being assessed to do its own due diligence.
Can the same firm do my readiness assessment and my HITRUST certification assessment?
Often, yes. HITRUST's Assessment Handbook allows assessor personnel to perform readiness or gap assessments for the same organization. What they cannot do is help implement or operate the controls being tested: anyone involved in that within the prior 12 months must stay off the validated assessment, and a separate team, including a separate engagement executive, is required.
How many HITRUST assessors should I talk to?
There is no rule. HITRUST's own directory lets you select up to five External Assessors or Readiness Licensees and will connect you with them. Comparing two or three detailed proposals on the same scope is a practical way to see differences in team, approach and price.