Total cost at a glance: in our engagements, implementation and assessment together cost about $15,000 for e1, about $40,000 for i1, and $150,000 to $200,000 for r2. HITRUST licence and report fees are paid directly to HITRUST and are not included in these figures. Check current HITRUST pricing for those.
CyberWave GRC is not a HITRUST External Assessor. HITRUST validated assessments are performed by our partner Huduku AI, a HITRUST Authorized External Assessor. CyberWave GRC provides readiness, implementation and certification support in partnership with Huduku AI.
What makes up the cost
| Assessment | Our implementation + assessment fee | Typical timeline |
|---|---|---|
| e1 | About $15,000 | 2 to 4 months |
| i1 | About $40,000 | 4 to 6 months |
| r2 | $150,000 to $200,000 | 9 to 12 months |
| HITRUST licence and report fees | Paid to HITRUST directly. Check current HITRUST pricing | Not applicable |
How company size and scope change the cost
The biggest factor is which assessment you choose. Each level, from e1 to i1 to r2, has more requirements than the one before. Our guide to HITRUST e1 vs i1 vs r2 explains how to pick. Within each level, the cost rises with the number of systems and facilities in scope. For r2, your risk factors add further requirement statements.
What pushes the cost up
- Scope. More systems and facilities and, for r2, risk factors that add requirement statements.
- Control gaps. Gaps must be fixed before the validated assessment can start.
- Not inheriting controls from your cloud provider. More controls then have to be tested directly.
How to keep the cost down
Start with the lowest assessment level your customers will accept. Inherit controls from your cloud provider wherever you can. Close control gaps before the validated assessment begins, and keep the scope tight.
Typical timeline
e1 takes 2 to 4 months, i1 takes 4 to 6 months, and r2 takes 9 to 12 months.
A typical engagement
*Illustrative scenario. This is not a specific client.*
A 60-person health-tech SaaS company hosted on a major cloud provider needs an e1 assessment. Implementation and assessment cost about $15,000. HITRUST fees are paid separately.
Get a HITRUST quote
Tell us which assessment you're targeting and what's in scope, and we'll send you a quote. Request a quote or see our HITRUST consulting and HIPAA compliance pages.