HITRUST understands that in certain instances, the third-party does not have a HITRUST assessment nor a report providing coverage of the expected requirements. In these situations, the External Assessor is only able to provide scoring of the third-party’s maturity level by direct testing of the requirement statements at the corresponding entity. HITRUST will accept this testing as long as the same testing rigor was utilized when testing the Assessed Entity. See Chapter 11 Testing & Evidence Requirements for testing expectations.