Authentication, Credential and Controlled Enterprise Security System at CMS

AccessCMS is an enterprise Identity, Credential, and Access Management (ICAM) platform that serves as the secure entry point for managing digital identities and access across the CMS environment. It supports identity lifecycle management by providing services for user registration, authentication, credentialing, vetting, and access approval for CMS employees, contractors, and other authorized users. The system is designed to ensure that only properly authorized and vetted individuals and systems can access CMS resources, while improving security, compliance, and operational efficiency.

To perform these functions, AccessCMS collects, stores, maintains, and shares information necessary to establish, verify, and manage user identities and access privileges. This information is used to identify and authenticate users, support credentialing and vetting processes, manage access throughout the user lifecycle, and enable secure access to CMS systems. The information may be stored permanently or temporarily, as appropriate, to support identity management, security, auditing, and compliance requirements.

• Social Security Number
• Passport Number
• Name
• Date of Birth
• Employment Status
• Legal Documents
• E-Mail Address
• Mailing Address
• Phone Numbers
• Other - Birth place, Company name and address, Alien Registration number, Visa Number, Work Permit Number, Sex, Citizenship information, Contact Information, Resume, Federal Agency affiliation, CMS/HHS/Harp ID information, and internal administration information, system access history, workflows, and approvals necessary to grant various types of access.

• Employees
• Business Partners/Contacts (Federal, state, local agencies)

• Executive Order 9397

• Title 5 U.S.C 301 Departmental Regulations

• Online

• Within the OPDIV
• Other HHS OPDIV
• State/Local/Tribal
• Foreign
• Other Federal Entities

• Within HHS: PII is used to uniquely identify CMS information system users.

• Users: Users will only have access to their own PII unless they are given one of the other roles listed below. 
• Administrators: Database administrators, system administrators, who are either CMS employees or direct contractors, will have various access levels to PII to perform system functions or manage other  user AccessCMS accounts. 
• Developers: Developers have access to PII for database migration and reporting activities. This access window is monitored to ensure data integrity.
• Others - Federal Approvers/COR, FNMS team, and Roster Owners: While not full administrators on the systems, the Federal approvers/CORs, FNMS team, and Roster owners all require access to the PII of the Users that they are managing or approver. The information is used to verify who the users is who they say they are. 

The CMS Information Security and Privacy Awareness Training is required to be completed by all users on an annual basis. This training is mandatory for continued access to CMS systems.

In addition, the direct contractor organizations require their staff to take company-sponsored annual security and privacy training. In both scenarios, users acknowledge successful training after passing a test at the end of training and the system verifies completion.

AccessCMS follows the CMS Records Control Schedules located on the cms.gov website and the National Archives and Records Administration (NARA) website. 

For CMS and the information systems that support its missions, NARA Transmittal 29 includes the General Records Schedules (GRS) that are followed. GRS 3.2 provides the requirements for the retention and destruction of PII handled by AccessCMS. For System Access Records (GRS 3.2 Item 030), EUA retains records for up to six (6) years to enable the recreation of computer related access to both the operation system and the application wherever PII is stored. 

AccessCMS follows the guidance of National Institute of Standards and Technology (NIST) Special Publication 800-88 Rev. 1 as part of the implementation of the Media Protection Security controls. AccessCMS will disintegrate, pulverize, melt, incinerate, and/or shred PII data once it is no longer necessary to retain. Certificates of destruction are completed and retained whenever PII data is destroyed.

Administrative: The administrative controls in place to secure PII include role-based access and permissions, periodic review of users and deletion or revoking of user accounts. Only authorized administrators can approve requests and there is a multi-tier process to authorize access. 

Technical: The technical controls in place are firewalls that prevent unauthorized access, encrypted access at log on, security scans, penetration testing, and intrusion detection and prevention systems (IDS/IPS) and computer system controls that prevent users without administrative or developer access too long into a test environment and the test environment and usable application are not joined together. 

Physical: AccessCMS is hosted in a secure data center (CDM AWS) that employs physical controls and monitoring to restrict physical access and ensure the security of doors with the use of security cards and pass codes; environmental controls that ensure the efficacy of heating, ventilation and air conditioning; smoke and fire alarms, and fire suppression systems; and by employing cameras, fencing and security guards.