HITRUST i1 vs r2 (2026): Honest Verdict + Implementation Help
HITRUST i1 is a fixed assessment of 182 controls that provides moderate, threat-adaptive assurance and is valid for one year, while r2 is a risk-based assessment that tailors control requirements to your risk profile and provides HITRUST's highest level of assurance (per HITRUST, Sept 2026; r2 page). An r2 certification is valid for two years, but HITRUST requires an interim assessment after the first year. r2 evaluates policy, procedure and implementation, whereas i1 focuses on implementation and threat adaptability. Pick i1 for scalable assurance on a maturing program; pick r2 when you handle sensitive data or run high-risk systems, or a contract names it — i1 work can be applied toward r2 later.
| Per HITRUST, Sept 2026 | HITRUST i1 | HITRUST r2 |
|---|---|---|
| Assurance level | Moderate, threat-adaptive | Highest; tailored, risk-based |
| Controls | 182 (fixed set; scope can be defined) | Tailored to your risk profile — no fixed count published |
| What is evaluated | Implementation and threat adaptability | Policy, procedure and implementation |
| Certification validity | 1 year | 2 years |
| Interim assessment | None listed; year-two rapid recertification covers ~60 core controls | Required after one year |
| Typical use case | Maturing security programs, security-conscious vendors | Sensitive data or high-risk systems; healthcare, finance, government |
Related: HITRUST e1 vs i1 · HITRUST certified companies · HIPAA vs HITRUST
Same HITRUST CSF framework. Two very different assessment depths. One is a fixed annual snapshot. One is a risk-tailored, maturity-scored, two-year certification. Here is the real difference.
Head-to-Head Comparison
| Dimension | HITRUST i1 | HITRUST r2 |
|---|---|---|
| Control count | 182 controls (fixed set) | Tailored per organization — HITRUST publishes no fixed count |
| How scope is set | Organizations define scope; control set is fixed | Controls selected and tailored to risk profile, technology environment, operations and scope |
| What is evaluated | Implementation and threat adaptability | Policy, procedure and implementation (scored evaluation) |
| Validity | 1 year; year-two rapid recertification (~60 core controls) | 2 years + required interim assessment after one year |
| Framework mapping | Built on the HITRUST CSF | Built on the HITRUST CSF, which maps to 60+ authoritative sources (HIPAA, NIST, ISO, PCI, GDPR) |
| Assurance level | Moderate | Highest HITRUST assurance level |
| Typical timeline | 6–12 months for most organizations (per HITRUST) | Varies with tailored scope |
| Re-use credit | Can be applied toward r2 | Builds on prior HITRUST work via the shared CSF |
| Best fit (our view) | SaaS / digital-health vendors with a maturing program | Vendors handling sensitive data for payers/health systems |
Cost Deep-Dive (All-In, 2026 Estimates)
All-in means MyCSF subscription + external assessor (CPA/HITRUST authorized firm) fees + internal labor + remediation tooling. HITRUST does not publish fixed prices; these are operator-honest market ranges, not quotes.
| Cost component | HITRUST i1 | HITRUST r2 |
|---|---|---|
| MyCSF subscription | ~$3k–$6k/yr | ~$10k–$25k/yr (more controls, more sources) |
| External assessor fees | ~$20k–$40k | ~$40k–$90k+ |
| Readiness / remediation | ~$10k–$25k (lighter, fixed scope) | ~$25k–$75k (maturity docs across 5 levels) |
| Typical total Year 1 | ~$30k–$60k | ~$60k–$150k+ |
| Recurring cost | Annual; year-two rapid recertification (~60 core controls, per HITRUST) | Interim assessment after Year 1, full reassessment for a new 2-year cert |
Honest Verdict
The i1 wins on speed, cost, and predictability — it is a fixed 182-control assessment (HITRUST says most organizations finish in 6–12 months) that clears many vendor security questionnaires in our experience. The r2 wins on depth and assurance — it is the risk-tailored, two-year certification HITRUST calls its highest level of assurance, and the one that large payers and health systems specifically name in contracts. The mistake operators make is jumping straight to r2 because it sounds more impressive, then burning $100k+ and six months on assurance their customers never asked for. Start at i1. HITRUST says i1 assessment work can be applied toward r2 when your program is ready, so climbing later doesn't start from zero. Only go straight to r2 when a signed or pending contract explicitly requires it.
