Framework guide
HITRUST CSF Framework Guide
HITRUST CSF is a certifiable security and privacy framework that harmonizes the requirements of HIPAA, NIST 800-53, ISO 27001, PCI DSS, and other authorities into a single set of prescriptive controls, organized into 19 assessment domains. Certification requires a validated assessment with an authorized External Assessor.
By the Shieldra Compliance Team · Last updated July 2026
Key takeaways
- HITRUST CSF harmonizes HIPAA, NIST 800-53, ISO 27001, and PCI DSS into 19 assessment domains.
- Three assessment tiers build on each other: e1 (Essentials, 44 foundational controls), i1 (Implemented, 182 controls), and r2 (risk-scoped from a 2,000+ control pool).
- Controls are scored on a maturity model: policy, procedure, implemented, measured, managed.
- A validated assessment is performed with an authorized External Assessor and issued through the MyCSF portal — it is not a self-attestation.
- Health plans, health systems, and enterprise buyers frequently require HITRUST certification before trusting a vendor with sensitive health data.
What is HITRUST CSF?
HITRUST CSF is a certifiable framework rather than a regulation: it takes the requirements of HIPAA, NIST 800-53, ISO 27001, PCI DSS, and other authorities and harmonizes them into one set of prescriptive controls across 19 assessment domains. Unlike a self-attestation, certification is earned through a validated assessment performed with an authorized External Assessor and issued through the MyCSF portal.
Lower tiers are subsets of higher ones, so work done for an e1 carries forward into an i1 and then an r2 as an organization matures.
What are the e1, i1, and r2 assessment tiers?
| Tier | Scope | Controls |
|---|
| e1 (Essentials) | Foundational cybersecurity hygiene | 44 controls |
| i1 (Implemented) | Broader leading-practice coverage | 182 controls |
| r2 (Risk-based) | Scoped to your risk profile | Risk-scoped from a 2,000+ control pool |
The 19 HITRUST assessment domains
HITRUST organizes its controls into 19 assessment domains. The number of controls assessed in each depends on the tier and, for r2, your risk profile.
- Governance and risk: Information Protection Program; Risk Management; Third-Party Assurance; Education, Training & Awareness
- Access and identity: Access Control; Password Management; Audit Logging & Monitoring
- Endpoint, mobile, and media: Endpoint Protection; Mobile Device Security; Portable Media Security
- Network and transmission: network perimeter, wireless, and data-in-transit protections
- Plus configuration, vulnerability, incident, resilience, physical, and privacy domains
How is HITRUST scored?
Controls are scored on maturity — policy, procedure, implemented, measured, managed — rather than pass/fail. That means an assessor looks for documented policy, a written procedure, and evidence of actual implementation for each control in scope, with the higher maturity levels requiring measurement and active management.
Who needs HITRUST?
Digital health, health IT, payers, providers, and any vendor handling PHI whose customers require certification. Health plans and health systems use a HITRUST certificate as a trusted, standardized measure of vendor security — for many enterprise healthcare deals it is a procurement gate rather than a differentiator.
Shieldra includes HITRUST alongside HIPAA, SOC 2, and its other frameworks, with controls mapped across them so evidence collected once serves each framework it satisfies.
Frequently asked questions
What is HITRUST CSF in simple terms?
A certifiable security and privacy framework that harmonizes HIPAA, NIST 800-53, ISO 27001, PCI DSS, and other authorities into one set of prescriptive controls across 19 assessment domains, validated by an authorized External Assessor.
What is the difference between HITRUST e1, i1, and r2?
e1 covers 44 foundational controls, i1 covers 182 controls, and r2 is risk-scoped from a pool of more than 2,000 controls. Lower tiers are subsets of higher ones, so work carries forward as an organization matures.
Is HITRUST the same as HIPAA compliance?
No. HIPAA is a law; HITRUST is a certifiable framework that incorporates HIPAA requirements among others. A HITRUST certification is frequently used to demonstrate HIPAA-aligned security to customers, but it does not replace your own HIPAA obligations.
How is a HITRUST assessment scored?
On control maturity: policy, procedure, implemented, measured, and managed. A validated assessment is performed with an authorized External Assessor and issued through the MyCSF portal.
