You have a clean SOC 2 report, and then a hospital or payer asks for HITRUST. It can feel like starting again. It isn't. Most of the work you did for SOC 2 carries over, and knowing exactly what carries over is the fastest way to plan your HITRUST project.
This guide covers why SOC 2 holders get asked for HITRUST, what you can reuse, what's usually new, and a practical four-step path.
Why SOC 2 holders get asked for HITRUST
SOC 2 is widely accepted by technology buyers. Healthcare buyers often want something more specific. When you start selling to hospitals, health systems and payers, their vendor security teams may ask for HITRUST because it's built around healthcare data and ends in a certification issued by HITRUST itself.
The two are different kinds of result. A SOC 2 is an attestation report on your controls, issued by a licensed CPA firm. HITRUST is a certification: your controls are assessed against the HITRUST CSF, validated by an Authorized External Assessor, and quality-checked by HITRUST before it certifies you. Read our SOC 2 vs HITRUST comparison for a side-by-side view.
What carries over from SOC 2
Most SOC 2 programs already cover the core areas HITRUST looks at. In our experience, these are the areas where your existing work usually carries over:
| Area | What usually carries over | What to check for HITRUST |
|---|---|---|
| Policies | Your information security policy set | Whether each policy covers HITRUST's specific requirement statements |
| Access control | Joiner-mover-leaver process, MFA, access reviews | Review frequency and how PHI systems are covered |
| Change management | Approvals, testing and deployment records | Whether evidence covers every in-scope system |
| Logging and monitoring | Central logs, alerts and review records | Retention and review evidence for PHI systems |
| Vendor management | Vendor inventory, reviews and contracts | Coverage of vendors that handle PHI |
| Evidence | Screenshots, tickets, reports and records from your SOC 2 | Whether it matches the dates and scope of your HITRUST assessment |
HITRUST maps to SOC 2, and HITRUST CSF v11.8.0, released on 7 May 2026, refreshed its SOC 2 mappings. That mapping is what lets you reuse controls and evidence instead of rebuilding them.
What's usually new
Even with a strong SOC 2, expect some genuinely new work:
- Prescriptive requirement statements. SOC 2 lets you design your own controls to meet broad criteria. HITRUST gives you specific requirement statements, and each one needs to be met and evidenced.
- Maturity scoring for an r2. An r2 looks at how mature each control is, not just whether it exists. Documented policies and procedures matter as much as the control running.
- PHI-specific controls. HITRUST looks closely at how you handle PHI, so you may need controls your SOC 2 scope didn't need.
- MyCSF. HITRUST assessments are managed in HITRUST's MyCSF platform. You'll set up your assessment, scope and evidence there.
None of this is a reason to delay. It's the gap list, and it's usually much shorter than the list of things you already have.
A practical four-step path from SOC 2 to HITRUST
- Confirm the assessment and the deadline. Ask your customer whether they need an e1, i1 or r2, and by when. If they haven't decided, use our HITRUST assessment chooser to see which fits your situation.
- Map your SOC 2 controls to HITRUST. Line up your existing controls and evidence against the HITRUST requirements for that assessment. Mark each one as covered, partly covered or missing.
- Close the gaps and build evidence in MyCSF. Fix what's missing, update policies and procedures, and organize evidence in MyCSF. If you host on a certified cloud provider, map the controls you can inherit through HITRUST's Shared Responsibility and Inheritance Program. HITRUST states organizations can inherit 70% to 85% of requirements from participating cloud service providers.
- Complete the validated assessment. A HITRUST Authorized External Assessor tests your controls and submits the assessment. HITRUST then performs quality assurance and issues the certification.
e1, i1 or r2 after SOC 2?
Your customer's request decides this. If they leave it to you, here is how the three compare:
| e1 | i1 | r2 | |
|---|---|---|---|
| Controls | 44 foundational security controls | 182 control requirements | Tailored, risk-based control requirements |
| Certification valid for | 1 year | 1 year | 2 years, with an interim assessment |
| Best for | Startups and companies with a limited risk profile or less complexity | Organizations with a robust security program that want to show leading practices | Organizations that must show compliance with sources such as HIPAA or NIST CSF, or need control tailoring based on risk factors |
Many SOC 2 companies fit the i1 profile: a robust existing program that wants to show leading practices. If you must show HIPAA or NIST CSF compliance, plan for an r2. If your scope is small and your customer accepts it, an e1 can be a quick first step, and that work can be built on toward an i1 or r2.
Keep one control set for both
The worst outcome is two separate programs that drift apart. Keep one control set mapped to both SOC 2 and HITRUST, with one owner per control and one evidence library. Your SOC 2 auditor and your HITRUST assessor will each test against their own criteria, but your team only builds and runs each control once.
How CyberWave GRC helps
At CyberWave GRC, we run the readiness work for SOC 2 holders moving to HITRUST: scoping, gap assessment, remediation guidance, policies and evidence, MyCSF setup and inheritance mapping. The validated assessment is performed by Huduku AI, an independent HITRUST Authorized External Assessor we work with, and HITRUST issues the certification. We never certify our own work.
Our team includes HITRUST CCSFP and CHQP certified practitioners and has worked on 200+ SOC 1 and SOC 2 engagements, so we know both sides of the mapping. One recent example is a HITRUST e1 alongside SOC 2 for a US health tech company. See our HITRUST consulting page or compare options in our guide to the best HITRUST consultants.