HITRUST CSF (Common Security Framework) is a certifiable security framework, first built for US healthcare and now used as a general assurance program. It maps HIPAA, NIST 800-53, ISO 27001, PCI DSS, and other authoritative sources into one prescriptive control set, then audits against it through HITRUST-approved external assessors.
What are the three HITRUST CSF assessment tiers?
HITRUST issues three certificate types: e1 for foundational hygiene, i1 for implemented one-year assurance, and r2 for risk-based two-year assurance.
The e1 tier covers 44 controls and typically takes 6 to 8 weeks at around $35,000. The i1 tier covers 170 to 190 controls at roughly $70,000. The r2 tier is the highest assurance, starts near $100,000, and is valid for two years (HITRUST). Pricing varies by scope and assessor.
Why did CSF v11 change the cost calculus?
CSF v11 made i1 the baseline that rolls into r2, which cut the incremental effort to reach r2 by about 45 percent versus the old v9.6 path.
The practical effect is that vendors selling into US health payors can stage from i1 to r2 instead of running them as separate efforts (HITRUST press release). Most teams underestimate the gap between e1 and r2 staffing, so the staged path matters.
Why does HITRUST keep showing up in healthcare questionnaires?
Several large US health payors flow it down as a vendor requirement. Anthem, Cigna, and Humana ask for a current HITRUST certificate in procurement.
For a SaaS selling into health systems, a HITRUST certificate often substitutes for sending a full SIG response. It also raises confidence in TPRM reviews and frequently sits alongside SOC 2 Type 2.
Related terms
These adjacent terms describe the frameworks HITRUST CSF maps to and the assurance artifacts it lives next to during a healthcare vendor review.
- HIPAA - the US health privacy and security rule HITRUST originally translated into testable controls
- SOC 2 - the AICPA security audit US buyers usually pair with HITRUST for non-health customers
- ISO 27001 - one of the source frameworks HITRUST control statements derive from
- HDS - the French equivalent for hosting health data, scoped to EEA jurisdictions