External Assessors

External Assessors are organizations that have been approved by HITRUST for performing assessment and services associated with the HITRUST Assurance Program and the HITRUST CSF, a comprehensive security framework that incorporates the existing security requirements of organizations.

External Assessors are critical to HITRUST’s efforts to provide trained resources to organizations of varying size and complexity to assess compliance with security control requirements and document corrective action plans that align with the HITRUST CSF.

Readiness Licensees

Organizations that do not wish to join the HITRUST External Assessor program have the option to license the HITRUST CSF from HITRUST to conduct readiness assessments and provide consulting on HITRUST CSF control implementation. AICPA organizations that choose this option may also produce SOC 2 reports which contain an opinion on the applicable Trust Services Criteria and HITRUST CSF criteria. Please note, licensing the HITRUST CSF in this manner does not allow the firm to perform a HITRUST Implemented, 1-year (i1) Validated Assessment or a HITRUST Risk-based, 2-year (r2) Validated Assessment, which are the only ways for organizations to obtain HITRUST Certification. HITRUST i1 and r2 Validated Assessment engagements can only be performed by an approved HITRUST External Assessor organization.

How Do I Become a HITRUST External Assessor or Readiness Licensee?

In order to perform external consulting, readiness, or assessment services using the HITRUST CSF framework or MyCSF platform, an organization must have an active license with HITRUST. HITRUST performs a review of all applying assessor firms to ensure quality of the program. To begin your application, please refer to our HITRUST Requirements Document for details and links to the required application templates. If you have any questions regarding the application process, please contact us at csfassessor@hitrustalliance.net.

Search for a HITRUST Authorized External Assessor below.

Internal Assessors

Internal Assessors are those personnel who facilitate the HITRUST Assessment process by performing in-house testing in advance of an External Assessor’s validated assessment fieldwork. Internal Assessors are in-house or outsourced CCSFPs who are typically positioned within, or engaged by, an assessed entity’s Internal Audit Department, but could also be positioned within or engaged by any department meeting specific objectivity requirements, resource qualification requirements, and approval by HITRUST (through a defined application process).

Internal Assessors are part of an “Internal Assessment Function.” This function will typically be an Internal Audit Department or a team of consultants, but is not required to be as long as specific objectivity, competence, and application approval requirements are met.