HITRUST e1, i1 & r2 Assessment Readiness

What we assess

We establish assessment boundaries, applicable scoping factors, system dependencies, and responsibilities before evaluating evidence. e1, i1, and r2 are distinct assessment options rather than interchangeable labels. We confirm the required option and assessment version before building the work plan.

Evidence to prepare

• System inventory, boundary documentation, and assessment scoping information.
• Policies and procedures linked to the applicable requirement statements.
• Implementation and recurring operational records, including access reviews, security testing, training, and risk decisions.

Keep design evidence separate from operating evidence. An approved procedure shows how a control is designed; dated records show whether it ran consistently over the review period. Evidence should identify its source, owner, scope, and collection date.

What you receive

• Assessment selection and scope recommendations tied to customer needs.
• Readiness findings, evidence-owner assignments, and a remediation roadmap.
• Structured evidence review and validated-assessment coordination under the agreed assessor engagement.

Common questions

Which HITRUST assessment should we choose?

Begin with the customer contract and the risk profile of the service. We compare those requirements with e1, i1, and r2 and confirm the intended assessment before estimating scope or effort.

What determines the engagement timeline and cost?

The system boundary, number of entities and locations, existing control maturity, evidence availability, and assessment pathway determine the effort. Share your customer requirements and target milestone so we can define a realistic scope before proposing a schedule.