HITRUST certification is becoming an increasingly important requirement for organizations that need to demonstrate security assurance to customers, partners, regulators, and other stakeholders. But in 2026, simply deciding to pursue “HITRUST certification” is no longer enough.
Organizations need to determine which HITRUST assessment is right for their environment, what has changed in the latest CSF version, and whether their existing security program is ready for the level of assurance they want to achieve.
That decision matters even more following the release of HITRUST CSF v11.9.0 on September 24, 2026. The latest version introduces changes to the e1 and i1 assessment baselines, refreshed authoritative-source mappings, new considerations for emerging technologies, and an Agentic AI factor for HITRUST AI Security Certification.
For organizations planning a new certification, renewing an existing one, or evaluating whether to move from e1 to i1 or r2, understanding these changes should be the starting point.
HITRUST Certification Is Not One-Size-Fits-All
HITRUST offers a traversable portfolio of three core cybersecurity assessments:
- e1: Foundational cybersecurity assurance
- i1: Leading security practices and broader assurance
- r2: Risk-based, tailored assurance for more complex environments
All three are built on the HITRUST CSF, and work completed at one level can support progression to a more comprehensive assessment. The important point is that organizations should not automatically pursue the most extensive assessment.
The right choice depends on risk, business requirements, regulatory obligations, customer expectations, technology complexity, data sensitivity, and security maturity.
An organization entering the HITRUST ecosystem may have very different requirements from an organization that already maintains an established HITRUST certification and is expanding into new markets.
What Changed in HITRUST CSF v11.9.0?
The latest CSF release is more than a routine framework update. HITRUST v11.9.0 includes:
- Updates to the e1 and i1 assessment baselines
- New, refreshed, and modified authoritative-source mappings
- Updated AI Security Certification content
- Mapping for the OWASP Top 10 for Agentic Applications 2026
- A new Agentic AI selectable factor for AI Security Certification
- Refreshed technology-specific requirements
- Updates involving PKI, TLS, and passkeys
- Considerations for post-quantum cryptography
- Targeted modifications to HIPAA Privacy and Security Rule mappings
This is significant because HITRUST is increasingly adapting its assurance framework to address technologies and threats that did not exist at the same scale when many organizations first established their security programs.
For organizations adopting AI, agentic applications, cloud technologies, or other emerging technologies, the latest CSF version should be considered when planning the next assessment.
HITRUST e1 in 2026: Foundational Assurance
The HITRUST e1 assessment is designed to provide foundational cybersecurity assurance. HITRUST positions e1 for startups, growing organizations, companies with lower risk profiles or less complex environments, and organizations looking to establish a foundation for more comprehensive HITRUST certification.
Under CSF v11.9.0, the e1 baseline contains 44 requirement statements. HITRUST confirms that all e1 requirements are included within the i1 baseline. For organizations considering e1, the value is not simply that it involves fewer requirements. It can provide a way to:
- Establish foundational cybersecurity controls
- Obtain independently validated assurance
- Demonstrate security maturity to customers and partners
- Establish a structured security baseline
- Build toward a future i1 or r2 assessment
However, organizations should not select e1 solely because it is the most streamlined option. The critical question is:
Does e1 provide the level of assurance your organization and stakeholders actually require?
If a customer, regulator, partner, or market requires a more comprehensive assessment, selecting e1 without validating that requirement first could create additional work later.
HITRUST i1 in 2026: Broader Assurance and Leading Practices
The HITRUST i1 assessment is designed for organizations with established information security programs that want to demonstrate leading security practices. The i1 baseline remains at 182 requirement statements in CSF v11.9.0. Compared with e1, i1 provides broader assurance and addresses a wider set of security practices and active threats. Organizations may consider i1 when they:
- Already have a mature information security program
- Work with security-conscious enterprise customers
- Handle sensitive or regulated information
- Need more comprehensive assurance than e1
- Want to demonstrate leading security practices
- Plan to progress toward r2
HITRUST also designed its assessments to be traversable. Work completed as part of an active i1 certification can be applied toward a future r2 assessment. That makes i1 particularly relevant for organizations that want to strengthen their assurance program progressively rather than treating every certification as an isolated project.
HITRUST r2 in 2026: Risk-Based and Tailored Assurance
The HITRUST r2 assessment provides the highest level of assurance within the core HITRUST cybersecurity certification portfolio. Unlike the fixed baselines used for e1 and i1, r2 provides a risk-based and tailored assessment that can account for factors such as regulatory requirements, data volumes, technology environments, and other organizational risk factors. r2 can be particularly relevant for organizations that:
- Operate in highly regulated industries
- Handle significant volumes of sensitive or regulated data
- Have complex technology environments
- Face extensive customer assurance requirements
- Need to address multiple authoritative sources
- Require a more comprehensive, risk-based assessment
- Need to demonstrate a higher level of assurance to external stakeholders
HITRUST describes r2 as a two-year certification, compared with the one-year certification period for e1 and i1. The decision to pursue r2, however, should be based on the organization’s actual assurance requirements rather than the assumption that the highest certification is automatically the right one.
e1 vs. i1 vs. r2: Which Assessment Is Right for Your Organization?
A useful way to look at the three assessments is through the type of assurance your organization needs.
- Best suited for: Organizations establishing foundational cybersecurity assurance
- 2026 baseline: 44 requirement statements
- Certification: 1 year
- Typical objective: Establish a validated cybersecurity foundation
- Best suited for: Organizations with established security programs seeking broader assurance
- 2026 baseline: 182 requirement statements
- Certification: 1 year
- Typical objective: Demonstrate leading security practices
- Best suited for: Organizations with greater complexity, risk, regulatory, or assurance requirements
- Assessment: Risk-based and tailored
- Certification: 2 years
- Typical objective: Demonstrate comprehensive, tailored cybersecurity assurance
The important distinction is not simply the number of requirements. It is how the assessment aligns with your organization’s risk and assurance objectives.
What Does the 2026 HITRUST Trust Report Tell Us?
The market is also showing an interesting shift in how organizations are approaching HITRUST. According to HITRUST’s 2026 Trust Report, 67.7% of new HITRUST customers selected e1 in 2025, compared with 10.5% selecting i1 and 21.8% selecting r2. At the same time, more than two-thirds of active HITRUST certifications were r2.
That tells an important story.
Organizations are increasingly using e1 as an entry point into validated assurance, while r2 remains highly prevalent among established HITRUST-certified organizations.
This creates a potential progression:
e1 → i1 → r2
But that progression is not mandatory for every organization. The right path depends on what your organization needs to demonstrate today and how its security and compliance requirements are expected to evolve.
Why Your Existing HITRUST Certification May Need to Be Reassessed
Organizations that already have HITRUST certification should not assume that their existing program automatically maps cleanly to the latest requirements. CSF v11.9.0 introduces changes to e1 and i1 baselines and updates multiple authoritative sources. HITRUST has also continued to evolve its AI security capabilities and technology-specific requirements. This makes 2026 a useful point for organizations to ask:
- Is our current certification still aligned with our business requirements?
- Are we using the right CSF version?
- Have our systems or data changed since our last assessment?
- Have new AI systems or agents entered our environment?
- Have our customer or regulatory requirements changed?
- Are our existing controls and evidence still sufficient?
A certification should reflect the organization’s current environment, not simply preserve the controls that existed when the original assessment was performed.
New HITRUST Assessments Must Account for the v11.9 Transition
The latest version also creates an important timeline for organizations starting e1 or i1 assessments. Between the release of CSF v11.9.0 on September 24, 2026 and December 31, 2026, organizations can create e1 and i1 assessments using either v11.8.0 or v11.9.0.
Starting December 31, 2026, new e1 and i1 assessment objects must use v11.9.0.
Then, from March 31, 2027, e1 and i1 assessments created using v11.8.0 or earlier can no longer be submitted for processing and will need to be upgraded to v11.9.0 or later.
For organizations currently planning an assessment, this makes version selection an important part of the project plan.
Starting an assessment today without considering the v11.9 transition could create avoidable work later.
HITRUST and AI: A Bigger Consideration in 2026
AI is changing what organizations need to consider when evaluating their cybersecurity posture. Organizations are deploying generative AI, AI-enabled applications, autonomous agents, and AI-integrated workflows across business and technology environments.
HITRUST’s latest CSF release reflects this shift. Version 11.9.0 added mapping for the OWASP Top 10 for Agentic Applications 2026 and introduced an Agentic AI selectable factor within the HITRUST AI Security Certification. HITRUST also updated AI Security Certification content in response to AI-enabled vulnerability research.
For organizations using or developing AI, this creates a broader question:
Does your existing cybersecurity assurance program adequately address the risks introduced by AI?
HITRUST’s AI Security Certification can add up to 44 AI-specific requirements, depending on the outcome of the AI risk analysis. These requirements are designed to address security risks associated with deployed AI systems. This can make AI Security a relevant consideration alongside an organization’s e1, i1, or r2 strategy.
HITRUST Is More Than a Certification Exercise
The biggest mistake organizations can make is treating HITRUST as a checklist. A successful certification program requires more than having policies that correspond to requirements. Organizations need to demonstrate that controls are:
- Appropriately designed
- Implemented
- Operating effectively
- Supported by evidence
- Owned by accountable teams
- Consistently maintained
That is why readiness matters before the formal assessment begins.
A proper readiness exercise can identify where an organization has:
- Missing or incomplete controls
- Policies that do not reflect actual practices
- Inconsistent operational processes
- Insufficient evidence
- Unclear control ownership
- Scope gaps
- Third-party dependencies
- Technology-specific security gaps
- AI-related risks that have not been incorporated into the security program
Finding these issues before the assessment gives the organization time to remediate them strategically.
What Organizations Should Do Before Starting a HITRUST Assessment
A successful HITRUST program should start with four decisions.
- Determine the right assessment: Evaluate whether e1, i1, or r2 aligns with your organization’s risk profile, business requirements, customer expectations, and regulatory obligations.
- Define the scope: Establish exactly which systems, applications, data, processes, facilities, third parties, and technologies will fall within the assessment boundary.
- Perform a readiness and gap assessment: Determine where the organization currently stands against the applicable requirements. The objective should not simply be to identify gaps. It should be to understand which gaps could affect certification, how significant they are, who owns remediation, and what needs to happen before the formal assessment.
- Build an evidence and remediation roadmap
A control is only useful during an assessment if the organization can demonstrate that it operates. Evidence should therefore be planned alongside remediation rather than collected at the last minute.
Why Organizations Work With Accorian for HITRUST
HITRUST certification can become a significant undertaking when organizations attempt to navigate assessment selection, scope, control implementation, evidence, remediation, and validation independently.
Accorian has been a HITRUST CSF Assessor since 2019, helping organizations navigate cybersecurity and compliance requirements across different environments. Our approach goes beyond helping organizations prepare for an assessment. We help organizations understand what they need to achieve, where they currently stand, and what needs to change to get there.
Accorian can support organizations with:
HITRUST Assessment Selection
Determine whether e1, i1, or r2 is appropriate based on organizational risk, customer requirements, regulatory obligations, and business objectives.
HITRUST Readiness Assessment
Evaluate existing controls, processes, documentation, and evidence against the applicable HITRUST requirements.
Gap Assessment and Remediation
Identify and prioritize gaps and develop a practical roadmap to address them before the formal assessment.
HITRUST Certification Preparation
Prepare teams, controls, evidence, and documentation for independent validation.
HITRUST AI Security
Address security considerations associated with AI systems, generative AI, and emerging agentic AI environments.
Ongoing Compliance
Help organizations maintain their security and compliance posture beyond the certification date.
The goal is simple:
Help your organization pursue the right HITRUST assessment with fewer surprises, clearer remediation priorities, and greater confidence in its readiness.
Is Your Organization Ready for HITRUST in 2026?
If your organization is considering HITRUST for the first time, moving from e1 to i1 or r2, renewing an existing certification, or evaluating how AI affects your assurance program, 2026 is the right time to reassess your approach.
CSF v11.9.0 has changed the assessment landscape. AI and agentic applications are introducing new security considerations. Customer expectations continue to evolve. And organizations need assurance programs that reflect the environments they operate today, not the environments they had when their last assessment began.
The question is no longer simply:
“Are we HITRUST certified?”
It is:
“Does our HITRUST certification reflect the level of assurance our organization needs today?”
If you are unsure whether e1, i1, r2, or HITRUST AI Security is the right path for your organization, Accorian can help you evaluate your requirements, assess your readiness, identify gaps, and build a practical path toward certification.
Start your HITRUST journey with the right assessment, the right scope, and the right readiness strategy.
Talk to Accorian about your HITRUST requirements.
