HITRUST e1 vs i1 vs r2: What's the Difference?

HITRUST e1, i1, and r2 are three assessment paths offering progressively broader levels of assurance. e1 is a focused foundational approach, i1 provides broader cybersecurity assurance, and r2 is the most comprehensive and risk-tailored of the three. Which one fits depends on customer requirements, risk, program maturity, and what is in scope.

The more useful framing is not which is hardest. It is which one your buyers will accept, and what your organization can realistically operate.

The three paths at a high level

e1: foundational assurance

Designed as a more focused entry point for organizations seeking validated assurance around foundational cybersecurity practices. It suits companies that need to demonstrate a credible baseline without committing to the full scope of a broader assessment.

i1: broader cybersecurity assurance

Designed for organizations that need a broader level of assurance around established cybersecurity practices. It is a meaningful step up in breadth from e1 while remaining more standardized than r2.

r2: risk-based, tailored assurance

The most comprehensive of the three core assessment approaches, designed for organizations that require more extensive tailoring based on risk, regulatory requirements, and the environment being assessed. That tailoring is the point, and it is also what makes r2 the most operationally demanding.

What actually decides the path

In practice, four things:

• What your customer requires. This overrides almost everything else. If a contract or vendor process specifies a path, that is your answer.
• The maturity of your program. A more comprehensive assessment assumes controls are already operating consistently. Choosing a path your program cannot yet sustain converts an assessment into a remediation project with a deadline attached.
• Scope. Which systems, environments, and entities are included. Scope drives effort more than most teams anticipate.
• The assurance your market expects. Some buyers are satisfied by a baseline. Others will not move without the most comprehensive option.

The reusability point

Work across the HITRUST assessment portfolio is designed to be increasingly reusable as organizations move toward more comprehensive assurance. Effort invested in getting policies accurate, controls owned, and evidence generated consistently does not evaporate if you later pursue a broader path.

That matters for sequencing. Starting at a level your program can genuinely sustain, and moving up as the business grows, is often more durable than reaching for the most comprehensive option first and discovering mid-assessment that the underlying operations were not ready.

What none of this decides for you

We will not tell you that one path is universally correct, because that depends on facts specific to your company and your customers. Formal assessment decisions should also be coordinated with the appropriate authorized HITRUST resources, who can speak to the assessment requirements directly.

What 22 can do is help you evaluate the business drivers, the current state of your program, and the operational implications of each path, then build and operate the program underneath whichever one you choose. See HITRUST program support for how that works.