Many teams enter a HITRUST engagement expecting a simple pass-or-fail result. A policy exists, a control runs, and a box gets checked. HITRUST works differently. Assessors evaluate applicable requirement statements against HITRUST’s scoring methodology, which accounts for how controls are documented and how they operate in practice.
This article builds upon our webinar, “Getting HITRUST Ready: Scope, Timeline, & Key Considerations,” and covers how HITRUST scoring works and what assessors look for when evaluating control maturity. Understanding the methodology can help teams prepare appropriate documentation, identify control gaps, and assign responsibility before validation begins.
How HITRUST Scoring Works
HITRUST scoring varies based on the type of assessment being performed.
For an e1 or i1 Assessment, only the Implemented Maturity Level is scored. An r2 Assessment can include five Maturity Levels: Policy, Procedure, Implemented, Measured, and Managed.
When all five Maturity Levels are included within an r2 Assessment, the HITRUST scoring model assigns the following weights:
| Maturity Level | What Assessors Evaluate in an r2 Assessment | Weight |
|---|---|---|
| Policy | Are expectations formally documented and mandatory? | 15% |
| Procedure | Is there documented guidance for performing the requirement? | 20% |
| Implemented | Is the requirement operating as intended across the relevant scope? | 40% |
| Measured | Is the control formally monitored for operation or effectiveness? | 10% |
| Managed | Are identified issues addressed through risk treatment and corrective action? | 15% |
Implemented carries the greatest weight of the five scored levels, which emphasizes the point that strong documentation alone doesn’t demonstrate that a control is operating as intended.
“HITRUST is quantitative in nature. You’re not trying to seek perfection, but you’re really trying to make sure you’re monitoring that Maturity Level.” – Ryan Boggs, Principal, SOC & HITRUST
Policy & Procedure: Two Different Purposes
Policy and Procedure address different questions within HITRUST’s r2 maturity model.
Policy Asks: What Is Required?
At the Policy level, Assessors look for current, final, and approved policies or standard language which establishes the mandatory nature of the applicable evaluative elements and addresses the relevant assessment scope. The documentation does not need to use specific words such as “shall” or “will,” nor does it have to reside within a document titled “policy.” It’s recognized that policy statements may appear within standards, handbooks, guidelines, directives, or other documentation.
Procedure Asks: How Is the Requirement Carried Out?
Assessors look for documented procedures or processes that explain how the requirement is performed. The documentation should provide enough detail for a qualified individual to carry out the activity and address the relevant systems, facilities, and operations within scope.
Consider a user access review. A policy might establish that periodic access reviews are required. Supporting procedures could explain how reviews are performed, which systems are covered, how often reviews occur, who has responsibility for the activity, and how identified issues are addressed.
The HITRUST methodology doesn’t require Policy and Procedure content to reside within separate documents. What matters is whether the documentation supports the applicable maturity criteria.
Regardless of format, i.e., the relevant language within policies, standards, handbooks, guidelines, or directives, documentation should reflect what happens in practice. If a procedure establishes a quarterly review, for example, evidence should support that the review operates accordingly. A mismatch between documented expectations and actual practice may affect the Assessment result.
Implemented: Moving From Documentation to Operation
At the Implemented level, assessors check whether the applicable requirement is operating as intended across the relevant assessment scope.
Assessors use testing and supporting evidence to evaluate whether applicable controls have been implemented consistently across in-scope facilities, systems, and supporting infrastructure. Documentation alone generally doesn’t demonstrate implementation.
This distinction matters because Implemented accounts for 40% of the score when all five Maturity Levels are included.
Consistency doesn’t mean every system or location has to work exactly the same way. What matters is that the control works as intended wherever it applies. If there are significant differences in how the control works, then assessors may need to review those areas separately.
A key takeaway is that teams should look beyond whether a control exists. They should understand where the control applies, how it operates across the assessment scope, and what evidence demonstrates that operation.
Measured & Managed: Know What Applies Early
Measured and Managed each add another dimension to an r2 Assessment. These Maturity Levels focus on how an organization monitors its controls and responds when issues are identified.
Measured Asks: Are We Formally Monitoring How the Control Operates or Performs?
At the Measured level, Assessors look for defined measures or metrics that demonstrate how the organization monitors control operation and effectiveness. Relevant considerations include what is being measured, the data used, who is responsible, how frequently measurement and review occur, and how results are recorded. Metrics also involve tracking results over time against an established target or threshold.
Managed Asks: What Happens When Measurement Identifies an Issue?
At the Managed level, assessors weigh whether identified issues enter a risk treatment process that supports appropriate management involvement or escalation, issue tracking, risk-based decision making, and corrective action.
Measured and Managed do not apply to e1 and i1 Assessments. For an r2 Assessment, the Assessed Entity selects whether Measured and Managed will be included through its assessment configuration within MyCSF. An r2 certification can be achieved without including those Maturity Levels.
That makes this an important planning decision. Organizations pursuing an r2 Assessment should determine early whether Measured and Managed will be included and understand the evidence which will be needed.
Where HITRUST Scores Can Slip
Scoring gaps can emerge when documentation, operation, scope, and evidence do not align.
For example:
- A policy may exist but not clearly establish a mandatory requirement.
- A procedure may not provide enough detail to demonstrate how an activity is performed.
- Documentation may describe one process while operating evidence shows another.
- A control may not work as intended across all systems or locations where it applies.
- A metric may exist without a defined target, responsible party, or consistent method for reviewing results.
- An identified issue may lack a documented path for escalation or corrective action.
It’s also important to note that applicable requirement statements are scored according to the Maturity Levels used by the Assessment. Requirement statements designated as “Not Applicable,” with supporting rationale, are documented but excluded from scoring.
A Readiness Assessment can help uncover gaps before validation begins, providing time to address documentation, operating practices, evidence, and monitoring processes.
“A Readiness Assessment allows an assessor to plan and scope the engagement properly with the client and really helps them prepare for what’s to come. It’s like the study guide before the test.” – Will Koernig, Senior Manager, SOC & HITRUST
Use the Maturity Model as a Planning Tool
Taken together, HITRUST Maturity Levels provide a useful way to think about control readiness:
- Policy establishes what’s required.
- Procedure explains how the requirement is performed.
- Implemented addresses whether it’s operating as intended.
- Measured addresses how the organization monitors operation or effectiveness.
- Managed focuses on how identified issues are handled through risk-based treatment and corrective action.
This model can help organizations identify where preparation may be needed.
Actions to Take Now
- Decide which Maturity Level(s) your Assessment will include, and confirm the evidence your Assessor will need.
- Review policies for clear mandatory language, current approval, and coverage of the Assessment scope.
- Check that procedures name who, what, when, where, and how.
- Compare how each control runs across in-scope systems and locations.
- Assign an owner to each measurement and each corrective action.
How Forvis Mazars Can Help
Our SOC & HITRUST Solutions team members are available to assist you in refining processes, enhancing controls, maintaining regulatory excellence, and responding to third-party assurance requests. In addition, Forvis Mazars offers various HITRUST services, such as Readiness Assessments, to help meet your organization’s needs. For more in-depth insights, watch our HITRUST webinar on demand. If you have any questions or need assistance, please reach out to a professional at Forvis Mazars.