Choose your assessment
Select e1, i1, or r2 based on your business needs and the assurance your customers require.
HITRUST 
certification.Without the grind.
Prepare for HITRUST certification with the right assessment scope, automated evidence collection, and expert guidance. Build a realistic plan backed by technical security controls.
Right-sized assessment- Automated evidence
- Expert guidance
HITRUST readiness.
A clear path.
Choose your assessment, gather evidence, and prepare your team with a structured plan.
Automate evidence collection
Connect your systems to gather evidence continuously. Keep records current and reduce manual preparation before assessor reviews.
Work with experienced experts
Get guidance on assessor expectations, common gaps, and the steps needed to keep your project moving.
Verify your security controls
Use built-in penetration testing, vulnerability scanning, and security monitoring to test the controls behind your readiness program.
The right assessment.
For your requirements.
Compare e1, i1, and r2 by assurance level and scope. Your customer requirements help determine the right fit.
e1 Essentials
- Best for
- Foundational assurance for organizations building their security program.
- Requirements
- 44 requirement statements (CSF v11.9)
- Valid for
- 1 year
i1 Implemented
- Best for
- Broader assurance for established security programs.
- Requirements
- 182 requirement statements (CSF v11.9)
- Valid for
- 1 year
r2 Risk-based
- Best for
- The highest HITRUST assurance, tailored to organizational risk.
- Requirements
- Tailored to your risk profile and assessment scope
- Valid for
- 2 years, with an interim assessment after 1 year
We help you choose based on the assurance your customers need.
Security first. Compliance follows.HITRUST controls.
HITRUST controls.
Broader coverage.
HITRUST CSF maps to HIPAA, SOC 2, ISO 27001/27002, NIST CSF, NIST 800-53, PCI DSS, GDPR, and state privacy laws. Reuse assessed controls where relevant. Coverage depends on your scope.
Security first. Compliance follows.HITRUST controls.
HITRUST controls.
Broader coverage.
HITRUST CSF maps to HIPAA, SOC 2, ISO 27001/27002, NIST CSF, NIST 800-53, PCI DSS, GDPR, and state privacy laws. Reuse assessed controls where relevant. Coverage depends on your scope.
Real security.
Starts with a closer look.
We test the systems you actually run, not a questionnaire. Every check shows what’s working, what isn’t, and which frameworks each gap touches.
One gap.
More than one framework.
Every result maps to the frameworks it belongs to. One gap can hold back several at once.
Your agent fixes what it can.
It prepares the fix, you approve it, and we retest. One verified fix counts toward every framework that needs it.
An expert handles the rest.
Some gaps need human judgment. Your Oneleet expert works through the details with you and verifies the result.
One fix. Progress everywhere.
The same security work moves SOC 2, ISO 27001, GDPR, HIPAA, FedRAMP and ISO 42001 forward together. Explore the checks they share.
HITRUST questions,
answered plainly.
Assessment types, readiness work, and maintaining your certification.
How do we choose between e1, i1, and r2?
Match your customer requirements to your environment. e1 provides foundational assurance; i1 is broader; r2 tailors requirements to risk. We help define the appropriate readiness scope.
Is HITRUST only relevant to healthcare companies?
No. HITRUST is widely used in healthcare, but other industries can use its framework and assessments. Fit depends on your risk profile and stakeholder requirements.
Does HITRUST certification automatically mean HIPAA compliance?
No. HITRUST can support mapped HIPAA requirements, but does not remove your obligations. Coverage depends on assessment scope, applicable requirements, and how you operate.
Can we reuse existing SOC 2 or ISO 27001 work?
Yes. We map existing controls, policies, and evidence to your chosen HITRUST assessment and identify gaps. Another report or certificate is not automatically equivalent.
Who performs the validated HITRUST assessment?
A HITRUST-authorized External Assessor tests the requirements. HITRUST reviews the assessment for certification. Oneleet supports readiness, control implementation, and evidence preparation.
How long is a HITRUST certification valid?
e1 and i1 are valid for one year. r2 is valid for two years, with an interim assessment after one year. You must maintain the applicable requirements.
Your HITRUST assessment.
A realistic plan.
Let’s match your customer requirements to the right path to certification.