How often do I need to get a HITRUST CSF assessment report to support my third-party assurance requirements?

HITRUST CSF Validated Reports with Certification are valid for two years given the successful completion of an interim review (typically 12 months after the original assessment), that no breach and no significant changes have occurred relating to the scoped control environment. However, check with your business partner(s) to ensure this meets their requirements. Validated Reports not resulting in certification are point-in-time reports.

For more information, refer to the HITRUST CSF Assurance Program Detailed Overview.