HITRUST compliance guide
Key Takeaways
What is HITRUST?
HITRUST publishes voluntary, certifiable cybersecurity assessments. The r2 page read on November 7, 2026 says the HITRUST CSF maps to 60+ authoritative sources, including HIPAA, NIST, ISO, PCI, and GDPR, so one assessment can line up with more than one framework (HITRUST r2). That is HITRUST's description of its own framework.
It is not a statement that a customer, payer, or vendor contract requires HITRUST.
How do HITRUST e1, i1, and r2 differ?
Counts and terms below are from HITRUST's own pages, read November 7, 2026, except where an older advisory is named.
| e1 | i1 | r2 | |
|---|---|---|---|
| Assurance, in HITRUST's words | Foundational. HITRUST's i1 FAQ calls e1 the low-risk set. | Moderate | Highest |
| Controls | 43 essential controls (HITRUST e1) | 182 curated controls (HITRUST i1) | Tailored to risk. The r2 page does not publish one fixed count. |
| How long the certification lasts | 1 year | 1 year. HITRUST says year-two recertification focuses on approximately 60 core controls rather than all 182. | 2 years, with an interim assessment after one year |
| Who it is aimed at | Smaller or lower-risk organizations, or a first step | Maturing programs that want a fixed control set | Organizations with sensitive data or high-risk systems |
HAA 2023-001, dated January 12, 2023, described CSF version 11 with 44 requirement statements for e1 and 182 for i1, nested so i1 included the e1 set (HITRUST advisory). The e1 page read on November 7, 2026 says 43, not 44. Use 43 for the current e1 page, and keep 44 as the January 2023 advisory's number.
HITRUST's i1 page says the certification uses external assessor testing and HITRUST quality assurance. This page does not describe an assessor's private workflow.
Can puna.one certify HITRUST?
No. HITRUST's pages describe certification through an external assessor and HITRUST's own quality assurance. puna.one does not hold HITRUST certification and does not issue it. Readiness work, when someone asks for it, is scoping and control preparation before that assessor. Current hosting scope is separate, on the managed hosting page.
References
- HITRUST. e1 assessment. Read November 7, 2026. 43 essential controls, valid one year. https://hitrustalliance.net/assessments-and-certifications/e1
- HITRUST. i1 assessment. Read November 7, 2026. 182 controls, valid one year, year-two recertification described as approximately 60 core controls. https://hitrustalliance.net/assessments-and-certifications/i1
- HITRUST. r2 assessment. Read November 7, 2026. Two-year certification, interim assessment after one year, 60+ mapped sources. https://hitrustalliance.net/assessments-and-certifications/r2
- HITRUST. HAA 2023-001, CSF version 11. January 12, 2023. e1 stated as 44 requirement statements. https://hitrustalliance.net/advisories/haa-2023-001-csf-version-11-release
- Related page: managed hosting.
Guide only. puna.one does not hold, and this page does not imply, any certification, attestation or audit report for this framework.
The control counts are HITRUST's published figures on the dates above. They are not a puna.one measurement.