Search | CMS Information Security and Privacy Program

Skip to main content

General Information
Software Bill of Materials (SBOM)
A structured list of the components and modules that make up a piece of software, and the supply chain relationships between them
What is an SBOM? A “Software Bill of Materials” (SBOM …
Tools / Services
SaaS Governance (SaaSG)
Tracking, approving, and managing the security of SaaS applications at CMS
What is SaaS Governance? Software-as-a-Service (SaaS) — accessing …
Tools / Services
Threat Modeling
Design practices that facilitate secure software development through organization and collaboration
What is Threat Modeling? Threat modeling is a method of …
Policy Documents
RMH Chapter 16: System & Communications Protection
RMH Chapter 16 identifies the System & Communications Protection (SC) family of controls that monitor, control, and protect organizational communication at CMS
Introduction The Risk Management Handbook Chapter 16: System and Communications …
Policy Documents
Risk Management Handbook Chapter 15: System & Services Acquisition
RMH Chapter 15 provides procedures for the use of controls related to System Lifecycles, documentation, and acquisition
Introduction The Risk Management Handbook Chapter 15, System and Services …
Policy Documents
Risk Management Handbook Chapter 9: Maintenance (MA)
RMH Chapter 9 provides information about the Maintenance family of controls that provide rules for the maintenance of CMS systems
Introduction This Handbook outlines procedures to help CMS staff and …
Tools / Services
CMS Hybrid Cloud
Platform-As-A-Service with tools, security, and support services designed specifically for CMS
What is CMS Hybrid Cloud? CMS Hybrid Cloud is a …
Handbooks
CMS Threat Modeling Handbook
Information and resources for teams to help them initiate and complete their system threat model
Disclaimer: The information and resources in this document are driven …
Handbooks
CMS Key Management Handbook
Guidance on the management lifecycle of cryptographic keys: data used to lock or unlock functions, including authentication, authorization, and encryption
Background The management and security of cryptographic keys is essential …
Tools / Services
SaaS Security Posture Management (SSPM)
Cloud-based tooling to help CMS application teams continuously monitor and improve the security of their SaaS applications
What is SSPM? SaaS Security Posture Management (SSPM) is an …