Plan for 3 to 5 months for a HITRUST e1, 5 to 9 months for an i1 and 9 to 15 months for a first r2. The main variables are how much remediation you need, the mandatory 90 days that new controls must operate before testing, the 90 day limit on assessor fieldwork, and HITRUST’s quality assurance review after submission.
What are the phases of a HITRUST project?
| Phase | What happens | e1 | i1 | r2 |
| 1. Scoping and planning | Define scope, choose level, obtain MyCSF access, select assessor | 2 to 3 weeks | 3 to 4 weeks | 4 to 6 weeks |
| 2. Readiness assessment | Gap analysis against applicable requirements | 2 to 3 weeks | 4 to 6 weeks | 6 to 10 weeks |
| 3. Remediation | Close gaps, write policies and procedures, deploy tooling | 4 to 8 weeks | 8 to 16 weeks | 12 to 28 weeks |
| 4. Incubation | New or changed controls operate for 90 days | Overlaps remediation | Overlaps remediation | Overlaps remediation |
| 5. Validated assessment | Assessor tests and scores in MyCSF | 3 to 5 weeks | 6 to 10 weeks | 8 to 12 weeks |
| 6. HITRUST QA and reporting | HITRUST reviews, queries, issues report | 4 to 8 weeks | 4 to 8 weeks | 6 to 10 weeks |
Durations are planning assumptions based on typical engagements. Your readiness results will sharpen them.
What is the 90 day rule and why does it matter?
HITRUST requires a newly implemented control to operate for at least 90 days before an assessor can score it as implemented. Policies and procedures have a shorter incubation of 60 days.
Practical impact: if you deploy MFA, a SIEM or a new access review process in March, the earliest it can be tested is June. This rule, more than any other, explains why “certified in 60 days” promises are not credible unless the environment is already mature.
Mitigation: prioritise remediation of technical controls in the first weeks, and leave documentation polish for later.
What is the fieldwork window?
Once the assessor begins validated testing, fieldwork must be completed and submitted within 90 days. Evidence older than the window may need to be refreshed. Organisations that start fieldwork before control owners are available often breach the window and retest.
How long does HITRUST QA take?
After submission, HITRUST performs a check-in, reviews the assessor’s testing on a sample basis, raises queries, and issues a draft then final report. Turnaround depends on HITRUST’s queue and submission quality. Assessors book a QA reservation date in advance, so your submission date should be agreed early. Clean, well-documented workpapers shorten QA materially.
What slows HITRUST projects down?
1. Scope changes mid-project. Adding a product or data centre resets work.
2.Late remediation. Triggers the 90 day incubation late in the plan.
3. Control owner availability. Engineering release cycles compete with evidence requests.
4. Weak evidence. Screenshots without dates, populations that cannot be reconciled, missing samples.
5. Third-party dependencies. Waiting for a vendor’s SOC 2 or inheritance approval from a cloud provider.
6. CSF version cut-offs. Creating an assessment object on a version that is about to retire.
How can you go faster without cutting corners?
- Start with a rapid scoping workshop and freeze scope in writing.
- Run readiness and remediation in sprints with a weekly governance call.
- Use inheritance from HITRUST certified cloud providers to remove whole groups of requirements from your testing.
- Reuse SOC 2 and ISO 27001 evidence.
- Appoint a single accountable project lead with authority over control owners.
- Book the QA reservation early and work backwards.
- Choose e1 first if a deadline is tight. An e1 in four months can satisfy a customer while i1 or r2 proceeds.
Sample i1 plan working back from a customer deadline
| Month | Milestone |
| Month 0 | Scope frozen, assessor engaged, MyCSF object created |
| Month 1 | Readiness complete, remediation plan approved |
| Month 1 to 3 | Technical remediation first, then policy and procedure |
| Month 4 | Incubation complete for early controls, evidence dry run |
| Month 5 to 6 | Validated fieldwork |
| Month 6 | Submission to HITRUST |
| Month 7 to 8 | QA queries closed, certification letter issued |
Key takeaways
- e1: 3 to 5 months. i1: 5 to 9 months. r2: 9 to 15 months.
- The 90 day incubation rule sets the minimum timeline for immature environments.
- Fieldwork must be completed within 90 days.
- QA reservation dates should drive the plan.
- Scope discipline and early technical remediation are the fastest accelerators.
Frequently asked questions
Can I get HITRUST certified in three months?
An e1 is possible in roughly three months if core controls already operate. i1 and r2 are not realistic in that timeframe for a first-time organisation.
What is the HITRUST 90 day incubation period?
A newly implemented control must operate for at least 90 days before it can be tested and scored as implemented.
How long does HITRUST QA take?
Typically several weeks after submission, depending on HITRUST’s queue and the quality of the assessor’s workpapers.
How long does the assessor’s fieldwork take?
Usually three to twelve weeks depending on level, and it must be completed within a 90 day window.
Does recertification take as long as the first time?
No. With controls and evidence routines in place, recertification is generally much faster.
About Finstein
Finstein is a HITRUST Authorized External Assessor. Our team includes CCSFP and CHQP qualified HITRUST professionals, CISA certified auditors and ISO 27001 lead auditors, led by Chartered Accountants. We support readiness assessments, validated e1, i1 and r2 assessments, interim assessments and recertification for organisations in the US, India, the UK and the Middle East that serve US healthcare, using an efficient remote delivery model. Get a dated HITRUST project plan
