HITRUST PORTAL CONTACT US
Generic selectors
Exact matches only
Search in title
Search in content
Search in posts
Search in pages

External Assessors

External Assessors are organizations that have been approved by HITRUST for performing assessment and services associated with the HITRUST Assurance Program and the HITRUST CSF, a comprehensive security framework that incorporates the existing security requirements of organizations.

External Assessors are critical to HITRUST’s efforts to provide trained resources to organizations of varying size and complexity to assess compliance with security control requirements and document corrective action plans that align with the HITRUST CSF.

Readiness Licensees

Organizations that do not wish to join the HITRUST External Assessor program have the option to license the HITRUST CSF from HITRUST to conduct readiness assessments and provide consulting on HITRUST CSF control implementation. AICPA organizations that choose this option may also produce SOC 2 reports which contain an opinion on the applicable Trust Services Criteria and HITRUST CSF criteria. Please note, licensing the HITRUST CSF in this manner does not allow the firm to perform a HITRUST Implemented, 1-year (i1) Validated Assessment or a HITRUST Risk-based, 2-year (r2) Validated Assessment, which are the only ways for organizations to obtain HITRUST Certification. HITRUST i1 and r2 Validated Assessment engagements can only be performed by an approved HITRUST External Assessor organization.

How Do I Become a HITRUST External Assessor or Readiness Licensee?

In order to perform external consulting, readiness, or assessment services using the HITRUST CSF framework or MyCSF platform, an organization must have an active license with HITRUST. HITRUST performs a review of all applying assessor firms to ensure quality of the program. To begin your application, please refer to our HITRUST Requirements Document for details and links to the required application templates. If you have any questions regarding the application process, please contact us at csfassessor@hitrustalliance.net.

Search for a HITRUST Authorized External Assessor below.

OR FILTER THE RESULTS BELOW

Each HITRUST External Assessor Organization (“EA Organization”) has been through a vetting process and demonstrated the ability to perform HITRUST CSF Assessments. The HITRUST vetting process includes reviewing policies and procedures and the background of the individuals performing the assessments. All EA Organizations are required to maintain at least 5 CCSFPs and 2 CHQPs employed within their organization at all times.

Obtaining an EA Organization status indicates that the EA Organization has met all HITRUST requirements to perform HITRUST CSF Assessments and has demonstrated an apparent ability to perform HITRUST CSF Assessments successfully. Although HITRUST strives to ensure that the list of EA Organizations on this webpage remains current and that the EA Organizations continue to meet our standards, HITRUST cannot guarantee that any EA Organization will be successful in their role as an EA Organization on any specific engagement.

Chat Now

This is where you can start a live chat with a member of our team