For a HITRUST Assessment, a lot comes down to evidence. By the time fieldwork starts, scope and assessment type should be settled. What remains is showing that your controls are in place and backing up each assessor conclusion with documentation that a reviewer can follow. When evidence isn’t ready, it can lead to the last-minute fire drills that may delay certification.
This article picks up where our webinar, “Getting HITRUST Ready: Scope, Timeline, & Key Considerations,” left off. We’ll walk through how assessors document testing, what detail each conclusion needs, and how sampling guidance affects how much HITRUST evidence your team may need to pull together.
How Assessors Document Testing
Testing takes place within the client’s MyCSF tool. Engagement team members receive access, and HITRUST provides illustrative procedures which can help assessors review each requirement statement. The team reviews the documentation provided, performs observations, and drafts a response for each maturity level being tested. Those drafts rely on the requirement language and the illustrative procedures.
The responses are recorded within the Assessor Comment(s) column of the HITRUST Test Plan Workbook. A strong draft typically incorporates the illustrative procedures along with added detail and results. It also needs enough substance for a HITRUST reviewer to follow the work performed.
Here’s why that matters for your team. The assessor writes the comment, but that comment can only be as clear as the evidence your organization provides. Also, that evidence often comes from process owners within different departments. That’s why it can help to plan for evidence collection as its own step.
What Each Conclusion Needs
Each result or conclusion requires proper source documentation. Proper source documentation allows the HITRUST reviewer to see what was tested and where the support came from. The detail depends on the testing approach and the type of evidence. Here’s what to capture for common approaches:
- Policy and procedure inspections: The document name, version, and approval or effective date, plus the page or section that addresses the requirement. Before submitting, confirm each document was in effect during the assessment period, and name files so they map to the requirement statement they support.
- System evidence inspections (screenshots, configurations, and system-generated reports): The system or tool name, the date the evidence was generated, and enough context to tie it to the in-scope environment, such as the report parameters or query used. Capture screenshots that show the date and system name within the image rather than labeling them after the fact.
- Sample-based testing: The population source and period, the items selected for testing, and the support for each item. Confirming the population is complete for the period before providing it can help avoid reselecting samples later.
- Observations and walkthroughs: The date, the participants and their roles, the system or location observed, the process steps or settings reviewed, and the result. Ideally, the individuals who perform the control day to day lead the walkthrough, since they can best show how it operates in practice.
For illustration, a comment stating that an access policy was reviewed leaves a reviewer with questions. A comment that names the policy, cites the page, and notes the approval date can answer the questions. That detail also can help during HITRUST Quality Assurance (QA), and the related documents should be linked within MyCSF.
Gaps in this detail tend to follow familiar patterns:
- Screenshots arrive without dates.
- Documents lack version or approval information.
- Walkthrough notes omit the names of participants.
- Populations do not match the period under review.
Each of these can send an Assessor back to the client for more information, which can add time and cost to fieldwork. A review of evidence prior to submission can help catch any gaps.
How Sampling Works
HITRUST’s CSF Assessment Methodology sets minimum sample sizes based on how a control operates. Teams that know their control frequencies and population sizes early can forecast evidence volume more reliably.
| Sampling Scenario | Minimum Number of Items to Test |
|---|---|
| Manual control at a defined frequency | Daily: 25 days. Weekly: Five weeks. Monthly: Two months. Quarterly: Two quarters. Annual: One year, using the most recent occurrence. |
| Manual control at an undefined frequency, e.g., “as needed” | Population of 250 or more: 25 items. Population of 50 to 249: 10% of the population, rounded up. Population under 50: Three items up to the entire population, using professional judgment. |
| Point-in-time populations, such as endpoints and servers | Follow the guidance for manual controls with an undefined frequency. |
| Automated control | A test of one may be possible if the conditions below are met. Otherwise, a full sample applies. |
A few illustrative scenarios show how the minimums translate into evidence requests. A weekly control calls for five weeks of instances, and an annual control calls for the most recent annual occurrence. For an “as needed” control with 180 instances in the period, 10% of the population means 18 items. With 300 instances, the minimum is 25. HITRUST’s Sampling Calculator can help a team estimate sample sizes for manual controls, though your Assessor will confirm the final sample.
Automated controls often deserve a closer look. A test of one depends on testing the configuration, where configurable, and on testing the outcome that shows the system behaves as configured. If the control is configured on or embedded within multiple systems or tools, each one must be tested.
Sample selection and evidence retrieval can take time, particularly when records are stored within several locations. Plan ahead with your Assessor to confirm which records are needed and when to gather them. This process gives your team time to check that the population includes all relevant items for the required period and to identify missing supporting documentation.
Keeping Evidence on Schedule
Validated assessments carry firm submission dates. Missing one usually delays reporting because the QA window is delayed. Weekly status updates help keep the work moving, and a secure portal can support document transfers when files are not uploaded directly into MyCSF. Treating the submission date as a fixed milestone, and planning backward from it, can help reduce that risk.
A dedicated assessment team also can make a difference. Professionals with backgrounds in audit, compliance, and regulatory requirements, working from a defined work plan, can help keep requests organized and deadlines visible for those involved.
HITRUST Evidence & Sampling Steps to Consider
To help your team prepare for evidence requests and sampling, consider these steps:
- Build an evidence index that lists each document, its owner, and its date;
- Record the date, participants, and system or location for each walkthrough;
- Sort controls by frequency and by manual or automated operation;
- Estimate population sizes for controls that operate “as needed;” and
- Confirm submission dates and the document transfer method with your Assessor.
How Forvis Mazars Can Help
Our SOC & HITRUST professionals can help you plan evidence collection and sampling before fieldwork begins. Connect with us today to talk through your HITRUST Assessment.