A validated assessment is only available to organizations after performing a readiness assessment.

A validated assessment does not require a readiness assessment as a prerequisite.

A Readiness Assessment is optional and intended to help organizations self-identify gaps before a validated assessment.

A Validated Assessment involves an independent HITRUST Authorized External Assessor validating evidence and submitting results to HITRUST for quality assurance and potential certification.

Many organizations choose to do a readiness assessment first, but it is not mandatory.

Extract Reference (CCSFP Study Guide & HITRUST CSF Assurance Program [0020]):

Organizations may perform a readiness assessment prior to a validated assessment to identify gaps, but it is not required; validated assessments can be performed independently.