HITRUST CERTIFICATION

When your organization is sitting on a goldmine of sensitive data, you cannot afford to ignore any vulnerability. That is why HITRUST CSF offers a comprehensive approach to protecting that sensitive data. With HITRUST, you get a gold-standard certification that is a holistic, scalable, and customizable framework for companies of all sizes and risk profiles.

avertium hitrust authorized csf assessor-1

HITRUST e1

Essentials, 1-year Readiness / Validated Assessment

Designed for organizations in early stages of HITRUST.

HITRUST i1

Implemented, 1-Year Readiness / Validated Assessment

Applicable for small to medium sized organizations requiring a low / moderate assurance for customers or clients.

HITRUST r2

Risk-based, 2-Year Readiness / Validated Assessment

This validated assessment is typically conducted for a medium to large enterprise that has a mature security program.

HITRUST OUTCOMES

While HITRUST is effective, meeting its requirements is easier said than done.

To get HITRUST CSF certified, it takes a team that knows HITRUST. A team that knows your organization and its security gaps. And perhaps most importantly, it takes a team that has the time and consistency to achieve and maintain HITRUST. Luckily, that is where Avertium comes in. For all three assessments, Avertium’s External Assessors are here to help.

Get help navigating the complexities of HITRUST.

Whether you need help choosing a portal subscription or accurately scoping controls in the context of your unique environment, we can be your go-to resource.

Identify gaps in your security posture.

With a gap analysis assessment, we provide you insight into what you can expect throughout the HITRUST validation and certification process while also pinpointing shortcomings.

Drive efficiency and enhance security maturity.

You can get the most from the HITRUST process by integrating remediation services*, existing policies and procedures, and recognized security and compliance frameworks such as HIPAA, NIST, ISO, SOC 2, and PCI DSS.

*Remediation Services that maintain very strict boundaries between Managed services and our HITRUST program work.

Avoid a failed assessment with a trusted partnership.

Many other external assessors take a pass / fail approach to HITRUST, but Avertium’s approach is about partnership – not policing. We go the extra mile to be certain you understand what HITRUST means, how it works, and what you need to do to get the certification.

Save time and effort with Avertium’s one-to-many approach.

Gathering evidence for HITRUST can be frustrating with endless document requests. Avertium’s mission is to streamline that process by having one piece of evidence satisfy as many HITRUST requirement statements as possible.

Ensure continuous compliance well after your initial HITRUST certification.

Avertium ensures continuity in the value of your HITRUST certification by forming a long-term partnership with your organization.

WHY AVERTIUM?

Avertium brings context to the chaos of HITRUST.

BUSINESS-FIRST SECURITY

MORE SECURE

Our process was built to serve your business. We strive to bring clarity and efficiency to the chaos of HITRUST certification.

Working with us, you will get a phased approach that incorporates meticulous project management, clear guidance on what is needed and when it is needed, as well as regular check-ins with HITRUST specialists who are committed to translating the endless technical jargon into simple action steps.

CYBER FUSION ENGINE

MORE COMPLIANT

We approach HITRUST as a program rather than an audit. Evidence collection is scheduled and proactively planned throughout the year.

The rigorous and comprehensive nature of the HITRUST framework, combined with the context-based, holistic approach from Avertium, ensures your organization can address both security and compliance challenges in a unified way.

HUMAN ELEMENT

MORE ROI

Our team combines HITRUST authorized external assessors with managed and cloud security & compliance expertise – all under one roof – enabling us to help you navigate the complexities of HITRUST and minimize disruption in your daily operations.

We go the extra mile to be certain you understand what HITRUST means, how it works, and what you need to do to get the certification.

Assessment

Description

Purpose
(Use Case)

Number of Control Requirements Statement

Targeted Coverage

Certifiable Assessment

HITRUST Essentials, 1-year (e1) Validated Assessment

HITRUST Implemented, 1-Year (i1) Validated Assessment

HITRUST Risk-based, 2-Year (r2) Validated Assessment

(e1) is designed to align with the fast-paced business environment and involves an evaluation of an organization's information security and privacy program against a set of requirements derived from the HITECH Act, HIPAA, and other applicable regulations and standards. It is designed to cover basic Foundational Cybersecurity practices that address the assurance needs of lower-risk organizations.

(i1) Validated Assessment leverages a proven set of HITRUST-curated controls designed to ensure that an organization is exercising Leading Security Practices to implement a strong and broad cybersecurity program. The i1 Assessment falls between the level of assurance conveyed by the more foundational HITRUST e1 Essentials and the more rigorous r2 Expanded Practices Risk-based Assessments.

(r2) Validated Assessment is considered the gold standard for information protection assurances because of the comprehensiveness of control requirements, depth of review, and consistency of oversight. It consistently provides the highest level of assurance for organizations with the greatest risk exposure.

Designed for organizations in early stages of HITRUST.

When your vendors have lower inherent risk and need a simple / less demanding assurance
When assurance is needed for basic controls expected for almost all entities
When a quick evaluation of security maturity is required for essential cybersecurity controls, such as for a new vendor or entity

Applicable for small to medium-sized organizations requiring a low/moderate assurance for customers or clients.

For reliable measurement and assurance against a robust portfolio of cybersecurity controls.
To demonstrate broad protection against current and emerging threats, which can help meet contractual and compliance obligations.
To show justification for more favorable cyber insurance premiums.

This validated assessment is typically conducted for a medium to large enterprise that has a mature security program.

When assurances are needed over specific authoritative sources or international requirements.
For organizations processing large amounts of sensitive data and personal information, including PHI, PCI, PII, CUI, highly regulated industries, and trade secrets.
To Assess Once, Report Many™ for enterprises working in multiple industries with complex regulations such as NIST, PCI DSS, HIPAA, and more.
During an r2, the MyCSF® Compliance and Reporting Pack for HIPAA automatically compiles HIPAA compliance evidence.
When a NIST Scorecard Report is needed to demonstrate compliance with NIST Cybersecurity Framework controls.
When an organization’s customer has adopted HITRUST as the required assurance mechanism for doing business.
To gain a competitive advantage by strengthening business relationships.
To show justification for more favorable cyber insurance premiums.

44 (fixed)

182 (fixed)

300 - 2000 + (depending upon version selected)

–––

NIST SP 800-171, HIPAA Security Rule

NIST SP 800-171, HIPAA, FedRAMP, NIST CSF, AICPA TSC, PCI DSS, GDPR, and 37 others

Yes, 1 year

Yes, 2 years

HITRUST CERTIFICATION

AVERTIUM HITRUST CSF