Your customer asked for HITRUST certification. Find out which one you actually need.
One 30-minute call with a HITRUST consultant. You get a written readiness assessment that names your tier — e1, i1 or r2 — scoped against your inherent risk factors, every gap risk-rated, with a week-by-week plan to certification. Yours to keep, whether or not you work with us.
5.0 on G2
Compliance consulting
What lands in your inbox three days later
1
Your tier, and the reasoning behind it
e1, i1 or r2 — named, with the logic shown. We map what your customer actually asked for against your inherent risk factors, so you're not certifying to a level nobody required or discovering mid-assessment that you scoped too low.
2
Your scoped requirement count
An r2 can carry anywhere from 198 to over 2,000 requirement statements depending on your risk factors — the average in-scope assessment is around 360. You get your number, not a range.
3
Requirement-by-requirement gap analysis
Every requirement statement in scope for your tier, marked met, partial, or gap — with the evidence a HITRUST External Assessor will expect to see for each one.
4
Maturity scoring readiness
HITRUST doesn't score pass/fail — it scores maturity, domain by domain. Most teams have controls implemented but no measurement or management around them, and that's where scores fall short. We show you where you'd land today.
+
Platform and MyCSF configuration review
On Vanta, Drata, Secureframe or Thoropass? We audit the configuration too — disabled tests, partial integrations, controls showing green on evidence that wouldn't survive validation. If you've already opened a MyCSF object, we check whether it's scoped correctly before you spend another month against it.
The assessment is the first two phases. Yours free.
Scope and tier determination
Which entities, systems and data flows are in scope, what your customer's contract actually requires, and which of e1, i1 or r2 that lands you on. This single decision sets your cost, your timeline, and your requirement count.
Readiness gap assessment
The full requirement-by-requirement analysis against your tier, with every gap risk-rated and a prioritised remediation roadmap.
Control implementation and remediation
Closing the gaps — policies, procedures, and the operating evidence behind them, built to score at the maturity levels HITRUST actually measures.
MyCSF setup and requirement tailoring
Creating and scoping the assessment object correctly, confirming inherent risk factors, and tailoring requirement statements before the clock starts.
Evidence collection and internal validation
We assemble and score the evidence internally first, so weak requirements surface while they're still cheap to fix rather than during validation.
External Assessor selection and coordination
We help you pick an authorised External Assessor firm that fits your size and stage, and manage the relationship so you're not translating between assessor and engineering.
Validated assessment and QA support
We sit with you through fieldwork, HITRUST's QA review, and any corrective action plans, through to your certification letter.
Why would you give this away?
And we'd rather you decide whether to work with us after seeing how we think — with a document in your hands — than after a sales call where we tell you how good we are.
What actually happens on the call
The ask
What your customer, payer or health system actually requested — in their words — and what's riding on it.
Inherent risk factors
The structured questions that determine your tier and your requirement count: data volume, internet-facing systems, number of records, wireless, third parties. This is the part nobody else does for free.
Controls and evidence
A walkthrough of access management, risk management, endpoint and network protection, incident response, business continuity, third-party assurance and configuration management — where you stand and what's already documented.
Tooling and MyCSF
If you're on a compliance platform, we look at how it's actually configured. If you've already opened a MyCSF object, we check the scope. If you're on neither, we tell you whether you need either.
What happens next
We confirm what the report covers and when it lands. No pitch — if there's a fit, we'll talk about it after you've read it.
Teams who had to prove it to a customer, not just claim it
What I valued most working with Kevin was that he never operated like a vendor. From the first engagement, he and his team behaved as an embedded partner, sitting inside our pocesses, owning the work alongside us, and treating our certification as their own deliverables.
"Jai's clear communication and detailed readiness assessment for SOC2 ensured that we had a clear compliance roadmap. Their professional conduct and thorough understanding of SOC2 principles have not only prepared us for the audit but alo instilled greater confidence in our team regarding security measures."
"Cycore's assistance was highly valuable and appreciated. The deciding factor was their personalized approach to supporting our needs."
We chose Cycore because of their perfect balance of cost and expertise. Cycore operated with integrity and as a partner.
Having worked with a number of companies in the cybersecurity consulting space, working with Cycore was by far the easiest. Their client communication, transparency, and dedication to deadlines were excellent.
The role we play now is more of a supervisory position — it’s 1,000 times easier than when we were doing it ourselves. As founders, we wear a lot of hats. To be able to put that one down is just… chef’s kiss.
Being in the healthcare space, we take security and privacy seriously. Cycore's services allowed us to have the security expertise at hand when it mattered the most.
It easy to see why the team at Cycore is highly praised. They understood our company needs and executed well.
Cycore provided exemplary service in managing our compliance needs. Their team's experience is evident with how quickly they were able to solve our challenges.
All it took was 20 days for my team to have a strategy and playbook to execute SOC 2. All thanks to Cycore.
With Cycore, there's no need for my team and I to worry about security and privacy. Cycore keeps us up to date on our compliance program and notifies us ahead of time if they need something from us.
Security questionnaires were a hassle for our team to turn over quickly in our sales cyles. Cycore has managed to make this process more efficient.
The Cycore team has been nothing short of great in helping us reach SOC 2 attestation. Highly recommend.
Our team was short staffed and needed security expertise to continue building our security program. Cycore has been instrumental in our security posture success.
We were looking for an in-house CISO but once we heard about Cycore's vCISO services, we knew this is what we needed. Thank you Cycore!
Who this is for
A good fit if
- A health system, payer or enterprise customer has HITRUST in a contract or security review, and the deal is waiting on it
- You handle PHI or other regulated data — healthtech, digital health, SaaS, BPO or a healthcare service provider, roughly 20–500 people
- You need to be certified in the next 3–9 months
- You don't yet know whether you need e1, i1 or r2 — or you've been quoted for one and want a second opinion
- You have someone senior who owns this, even part-time
Probably not if
- You need a certification letter in under four weeks — that isn't achievable honestly, by anyone
- You're looking for a policy template pack rather than a certifiable control environment
- Nobody internally owns security and nobody's willing to
- You want the certificate without the controls behind it
Before you book
Is this a sales call in disguise?
Which assessment do we actually need — e1, i1 or r2?
How thorough can a report from a 30-minute call really be?
What if we're not on a compliance platform yet?
How long does HITRUST certification actually take?
What does HITRUST cost — including the parts you don't control?
Can we just take the report and do it ourselves?
We already have SOC 2 and HIPAA. Doesn't that count for something?
Every month you wait pushes your certification date
An r2 takes four to six months. This call takes thirty minutes and costs nothing — and it's the difference between planning against a real timeline and hoping your customer will wait.